General

  • Target

    d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c

  • Size

    159KB

  • Sample

    221204-hhrhjaad7v

  • MD5

    1b28fc597bf19d9c96be3ecd8424de63

  • SHA1

    66bcfe8638912a0991911aab7cb2f95fe9245df7

  • SHA256

    d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c

  • SHA512

    a128c6b3243c9bce2aefd85b57650f4e7dcfee574860902daa1d1a7832d8e964d3d32c1446d68c737eaa9d6ba734e26592af174fae5c2917c47432928b077cf0

  • SSDEEP

    3072:EZ4++394Pf3xI2fmFxaQOjCr33x0hB1ARNUYzdpQMJrly:EZ4++3y30FxLZHyhBKRiUVrl

Malware Config

Targets

    • Target

      d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c

    • Size

      159KB

    • MD5

      1b28fc597bf19d9c96be3ecd8424de63

    • SHA1

      66bcfe8638912a0991911aab7cb2f95fe9245df7

    • SHA256

      d864c770b13f2ec248d0304c70482a3da4b77045ac5fe6f18477f4f99bc7990c

    • SHA512

      a128c6b3243c9bce2aefd85b57650f4e7dcfee574860902daa1d1a7832d8e964d3d32c1446d68c737eaa9d6ba734e26592af174fae5c2917c47432928b077cf0

    • SSDEEP

      3072:EZ4++394Pf3xI2fmFxaQOjCr33x0hB1ARNUYzdpQMJrly:EZ4++3y30FxLZHyhBKRiUVrl

    • Modifies WinLogon for persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks