General

  • Target

    332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97

  • Size

    255KB

  • Sample

    221127-tn9f3sed8w

  • MD5

    d255718aa60e1d6b71388e7f048faed3

  • SHA1

    9f1b201ad15c6fb2f2abcf12c80fa73806a9d0a8

  • SHA256

    332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97

  • SHA512

    2c95c2cd8839773517dd3b7e8f18e27ba0d246a9968ff3d1056474a0a5185001736825de529033ed586dc71e779d142cd444c804d24523b4e2e95446a0aa442a

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJc:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIP

Malware Config

Targets

    • Target

      332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97

    • Size

      255KB

    • MD5

      d255718aa60e1d6b71388e7f048faed3

    • SHA1

      9f1b201ad15c6fb2f2abcf12c80fa73806a9d0a8

    • SHA256

      332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97

    • SHA512

      2c95c2cd8839773517dd3b7e8f18e27ba0d246a9968ff3d1056474a0a5185001736825de529033ed586dc71e779d142cd444c804d24523b4e2e95446a0aa442a

    • SSDEEP

      3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJc:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIP

    • Modifies visibility of file extensions in Explorer

    • Modifies visiblity of hidden/system files in Explorer

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies WinLogon

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

7
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks