General

  • Target

    5558da16990edbb980e38735a89f4fa649fc5fa67e66a99d96fd94c2c0c8ae07

  • Size

    2.6MB

  • Sample

    220524-1me96sdabq

  • MD5

    f94711a2952c01ce9bcaf36817c2b0bc

  • SHA1

    f084c4650bc662f642859e580ec53d2f260dc8b4

  • SHA256

    5558da16990edbb980e38735a89f4fa649fc5fa67e66a99d96fd94c2c0c8ae07

  • SHA512

    239aee19e7de6a952b0de7bea4783ad07a11cf8cf635647a7b132c071957fcfc5bd97a8c74bc400be7167a01e4fb37451a0d0c52de94eb9b7341ee62ffd0291d

Malware Config

Targets

    • Target

      5558da16990edbb980e38735a89f4fa649fc5fa67e66a99d96fd94c2c0c8ae07

    • Size

      2.6MB

    • MD5

      f94711a2952c01ce9bcaf36817c2b0bc

    • SHA1

      f084c4650bc662f642859e580ec53d2f260dc8b4

    • SHA256

      5558da16990edbb980e38735a89f4fa649fc5fa67e66a99d96fd94c2c0c8ae07

    • SHA512

      239aee19e7de6a952b0de7bea4783ad07a11cf8cf635647a7b132c071957fcfc5bd97a8c74bc400be7167a01e4fb37451a0d0c52de94eb9b7341ee62ffd0291d

    • Nirsoft

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Tasks