General

  • Target

    342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c

  • Size

    4.6MB

  • Sample

    221125-lwg3ssce8t

  • MD5

    78c279426e28a8188c1fc88d43f74061

  • SHA1

    7766849c6497f2d62f69758a2c7ea74c03c46d84

  • SHA256

    342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c

  • SHA512

    13ef7318605df54c129a8854113c740f59a9b11d0e6083834b9dc2f1aeace4f6bf21dd5d0561c8c74d7486a124f4a0a091cd557203d5da63a604c7b9e9d3792a

  • SSDEEP

    98304:ILtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:ILygVK9ieYrX3mCoFl6Mkj

Malware Config

Targets

    • Target

      342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c

    • Size

      4.6MB

    • MD5

      78c279426e28a8188c1fc88d43f74061

    • SHA1

      7766849c6497f2d62f69758a2c7ea74c03c46d84

    • SHA256

      342b887667d91099f3a2109bb8b2dbb08e4552ea8d6b3aad6dfa57a4eb0e079c

    • SHA512

      13ef7318605df54c129a8854113c740f59a9b11d0e6083834b9dc2f1aeace4f6bf21dd5d0561c8c74d7486a124f4a0a091cd557203d5da63a604c7b9e9d3792a

    • SSDEEP

      98304:ILtkZmzpySsQdbyuvoBYU8XlpTmCoFyCMPYT+Hrj:ILygVK9ieYrX3mCoFl6Mkj

    • Nirsoft

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

    • Drops Chrome extension

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks