General

  • Target

    071ef87936e73e6c0a8d468268d0875cfa0182466e8bd605baf53333f518aa7e

  • Size

    2.6MB

  • Sample

    220525-ajxryacga9

  • MD5

    a62d6ff65295dd8e3123cc949782493a

  • SHA1

    dc4248fad98f03f2005fe8020bb4d2e28db1acf1

  • SHA256

    071ef87936e73e6c0a8d468268d0875cfa0182466e8bd605baf53333f518aa7e

  • SHA512

    08c27dd12b87c1952ee1b9ffe9e44317aa057214e52ece4aed77b13460b3e6974c3c143a4c8c2da569acdfadddbfac9f6447e09a2f9d1fd4f31c300acc4f72c4

Malware Config

Targets

    • Target

      071ef87936e73e6c0a8d468268d0875cfa0182466e8bd605baf53333f518aa7e

    • Size

      2.6MB

    • MD5

      a62d6ff65295dd8e3123cc949782493a

    • SHA1

      dc4248fad98f03f2005fe8020bb4d2e28db1acf1

    • SHA256

      071ef87936e73e6c0a8d468268d0875cfa0182466e8bd605baf53333f518aa7e

    • SHA512

      08c27dd12b87c1952ee1b9ffe9e44317aa057214e52ece4aed77b13460b3e6974c3c143a4c8c2da569acdfadddbfac9f6447e09a2f9d1fd4f31c300acc4f72c4

    • Nirsoft

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Tasks