General

  • Target

    c8282959582ca34369c24e1bb7e44f950b5212549c2c6b985997c574d7a9789c

  • Size

    255KB

  • Sample

    221127-t3srwabh99

  • MD5

    cc0d1736600b6257bdc44119a914e403

  • SHA1

    582cf6a888723235886874cedb32fbdb6922bda9

  • SHA256

    c8282959582ca34369c24e1bb7e44f950b5212549c2c6b985997c574d7a9789c

  • SHA512

    695e6c8f997ee8483284f8627b0f3e02ebb67650fb9a5e78502b13fceecf70542149b3cb3af8034dcfd9574547d50ffea49edc2d7ddaac8a6ddfecac5ada9528

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ7:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI+

Malware Config

Targets

    • Target

      c8282959582ca34369c24e1bb7e44f950b5212549c2c6b985997c574d7a9789c

    • Size

      255KB

    • MD5

      cc0d1736600b6257bdc44119a914e403

    • SHA1

      582cf6a888723235886874cedb32fbdb6922bda9

    • SHA256

      c8282959582ca34369c24e1bb7e44f950b5212549c2c6b985997c574d7a9789c

    • SHA512

      695e6c8f997ee8483284f8627b0f3e02ebb67650fb9a5e78502b13fceecf70542149b3cb3af8034dcfd9574547d50ffea49edc2d7ddaac8a6ddfecac5ada9528

    • SSDEEP

      3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ7:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI+

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

7
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks