General

  • Target

    9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d

  • Size

    887KB

  • Sample

    221021-a13draddh6

  • MD5

    498d5b0dae4bb89ce636a3f000bc3360

  • SHA1

    d813622863215be48af5f29eb0465480b7009779

  • SHA256

    9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d

  • SHA512

    5b1dff856127930f23d70315740eaf2e9f4877d9f673759c24d46542c119f6e41ade62def91163efce983bdbaa969ecf42a1083dc3d3689b3ad9d6e13a504716

  • SSDEEP

    12288:cQyN/7YkrWBfWhvRhQUkcVS15NkiM6aOvYsRzBtHnwi/AXwnKRh4e2Y0Xp:cQyN/7DSBfWhkcVQ+6aOvYs1+0X

Malware Config

Targets

    • Target

      9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d

    • Size

      887KB

    • MD5

      498d5b0dae4bb89ce636a3f000bc3360

    • SHA1

      d813622863215be48af5f29eb0465480b7009779

    • SHA256

      9fdddaed0e2f035c30a1d43c9cf9b48e5c2aa1e8803bd542c1152beca59b4b3d

    • SHA512

      5b1dff856127930f23d70315740eaf2e9f4877d9f673759c24d46542c119f6e41ade62def91163efce983bdbaa969ecf42a1083dc3d3689b3ad9d6e13a504716

    • SSDEEP

      12288:cQyN/7YkrWBfWhvRhQUkcVS15NkiM6aOvYsRzBtHnwi/AXwnKRh4e2Y0Xp:cQyN/7DSBfWhkcVQ+6aOvYs1+0X

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops Chrome extension

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks