General

  • Target

    74333aa65e6a5e107fd715494c73023e35c041fa09556a19e062e8bbbaa729d9

  • Size

    1.0MB

  • Sample

    230425-gwhl4saf2z

  • MD5

    611cbca2add3b59bc4165c0c0d7941f0

  • SHA1

    e2405327b0e7d38aa132053523a0a6abc5f8ca6a

  • SHA256

    74333aa65e6a5e107fd715494c73023e35c041fa09556a19e062e8bbbaa729d9

  • SHA512

    ba449b1db968c0f67e756ab316bce355ea209c0d71ef853ed6e4e0fc8c715e597610af28db93fae90806d8a1fedb110fc823659fcf2f822e946e100312306069

  • SSDEEP

    24576:9qw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:H0Obw4Yt6OQlimjV3tSvc

Malware Config

Targets

    • Target

      74333aa65e6a5e107fd715494c73023e35c041fa09556a19e062e8bbbaa729d9

    • Size

      1.0MB

    • MD5

      611cbca2add3b59bc4165c0c0d7941f0

    • SHA1

      e2405327b0e7d38aa132053523a0a6abc5f8ca6a

    • SHA256

      74333aa65e6a5e107fd715494c73023e35c041fa09556a19e062e8bbbaa729d9

    • SHA512

      ba449b1db968c0f67e756ab316bce355ea209c0d71ef853ed6e4e0fc8c715e597610af28db93fae90806d8a1fedb110fc823659fcf2f822e946e100312306069

    • SSDEEP

      24576:9qw0OA/oz/04YtRHw/tOWaqbkCimjVkaHtSv8I+h:H0Obw4Yt6OQlimjV3tSvc

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks