General

  • Target

    7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a

  • Size

    4.6MB

  • Sample

    221125-lq333sgf93

  • MD5

    0323ae23d7c56924912bc262bfac689b

  • SHA1

    c58065b4cdf8871c1f59af94e8241af414ea478e

  • SHA256

    7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a

  • SHA512

    5633f4075ca82147c641e1db29835a73f4d0312b07ec69e9f58217c873afc57dae006f3c6b726f768cd45d1b0f4d2ca06384a85bcb4d2026e68b428e4ee072d0

  • SSDEEP

    98304:nLtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:nLygVK9ieYrX3mCoFl6Mkj

Malware Config

Targets

    • Target

      7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a

    • Size

      4.6MB

    • MD5

      0323ae23d7c56924912bc262bfac689b

    • SHA1

      c58065b4cdf8871c1f59af94e8241af414ea478e

    • SHA256

      7bdd03378063066b09faaf995de8a0548381afdba5ed742599b7616192c6ca2a

    • SHA512

      5633f4075ca82147c641e1db29835a73f4d0312b07ec69e9f58217c873afc57dae006f3c6b726f768cd45d1b0f4d2ca06384a85bcb4d2026e68b428e4ee072d0

    • SSDEEP

      98304:nLtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:nLygVK9ieYrX3mCoFl6Mkj

    • Nirsoft

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

    • Drops Chrome extension

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Tasks