Resubmissions

25-08-2022 10:41

220825-mrdp9abfcp 10

25-08-2022 10:27

220825-mheaesbdhn 10

General

  • Target

    iCUESetup_4.27.168_release.msi

  • Size

    1002.7MB

  • Sample

    220825-mrdp9abfcp

  • MD5

    f9ffbb07216d04c2bd8f39a7a84cca9d

  • SHA1

    04215fb570b465fd3d0e63dd221068b2af2a407a

  • SHA256

    4c08cca7ac9d329e4e885862e877cc0eec25a23dae9b6265064b57be3fa90181

  • SHA512

    f4af8d3600e5d1131c668119a495fde72256c8f06110a398dde988e2ca7159030c6e25ae6efa09ed3b793f09cd90f1cd488030174c6ea24ee94f637929e125e6

  • SSDEEP

    25165824:OcM4l/8abE3G9ieHZNcs1K3BKbLmOZh4h18caz6DsN:OcM4hPN7KxK/TZrYDsN

Malware Config

Targets

    • Target

      iCUESetup_4.27.168_release.msi

    • Size

      1002.7MB

    • MD5

      f9ffbb07216d04c2bd8f39a7a84cca9d

    • SHA1

      04215fb570b465fd3d0e63dd221068b2af2a407a

    • SHA256

      4c08cca7ac9d329e4e885862e877cc0eec25a23dae9b6265064b57be3fa90181

    • SHA512

      f4af8d3600e5d1131c668119a495fde72256c8f06110a398dde988e2ca7159030c6e25ae6efa09ed3b793f09cd90f1cd488030174c6ea24ee94f637929e125e6

    • SSDEEP

      25165824:OcM4l/8abE3G9ieHZNcs1K3BKbLmOZh4h18caz6DsN:OcM4hPN7KxK/TZrYDsN

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • Registers COM server for autorun

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

3
T1060

Defense Evasion

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

2
T1120

Collection

Data from Local System

1
T1005

Tasks