Resubmissions

01-04-2023 22:16

230401-166lgada92 3

01-04-2023 22:05

230401-1zm6jsed7y 7

General

  • Target

    IDMan.exe

  • Size

    5.6MB

  • Sample

    230401-1zm6jsed7y

  • MD5

    e0058fefc40216ebce70a63f2975204e

  • SHA1

    4c77ae3b2ab4066f357e90ef59f6f05a60fab9fc

  • SHA256

    7158dbcba678d6d493a75c2dce96a8f5e10a83bda77c911b9994e9c7ca0971c5

  • SHA512

    2de24620b156be391593c7aee57fd633732f75be502d7830131abb041421b7aab175d25d27a8b7323579eb631789580da8ddf5cf31acb542bd73e50597961717

  • SSDEEP

    98304:iqfdKBo2I2V8ABsF0sroOl11P4pQx18frP3wbzWFimaI7dlZe3:LfEBDjV8x0s0rgbzWFimaI7dl

Malware Config

Targets

    • Target

      IDMan.exe

    • Size

      5.6MB

    • MD5

      e0058fefc40216ebce70a63f2975204e

    • SHA1

      4c77ae3b2ab4066f357e90ef59f6f05a60fab9fc

    • SHA256

      7158dbcba678d6d493a75c2dce96a8f5e10a83bda77c911b9994e9c7ca0971c5

    • SHA512

      2de24620b156be391593c7aee57fd633732f75be502d7830131abb041421b7aab175d25d27a8b7323579eb631789580da8ddf5cf31acb542bd73e50597961717

    • SSDEEP

      98304:iqfdKBo2I2V8ABsF0sroOl11P4pQx18frP3wbzWFimaI7dlZe3:LfEBDjV8x0s0rgbzWFimaI7dl

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Tasks