General

  • Target

    915d59dcbe17aa53566572a8214c24c00940a284225a710c76e775a0ec9d30fb

  • Size

    695KB

  • Sample

    230425-wnemtacb54

  • MD5

    15f6631e6ecad2b4c0c77640f1259d8d

  • SHA1

    e5c1b81d675e170a609407f70dfe069d1922394a

  • SHA256

    915d59dcbe17aa53566572a8214c24c00940a284225a710c76e775a0ec9d30fb

  • SHA512

    51db485c7e3324fac552989c3d936953af75c316b0628239a7fd3e92198a38dcbfa93afaf4b97272fc634791dee7c1aea248e67524ec9be9759908d60f977a0f

  • SSDEEP

    12288:2y90VAHIaEd+rryjhkfJrszjTTT4erehqlniMVdUN0cRtbP1LBeSimdFf:2y9HqMrryjGavTTZqhqlPdUe4bVimdFf

Malware Config

Targets

    • Target

      915d59dcbe17aa53566572a8214c24c00940a284225a710c76e775a0ec9d30fb

    • Size

      695KB

    • MD5

      15f6631e6ecad2b4c0c77640f1259d8d

    • SHA1

      e5c1b81d675e170a609407f70dfe069d1922394a

    • SHA256

      915d59dcbe17aa53566572a8214c24c00940a284225a710c76e775a0ec9d30fb

    • SHA512

      51db485c7e3324fac552989c3d936953af75c316b0628239a7fd3e92198a38dcbfa93afaf4b97272fc634791dee7c1aea248e67524ec9be9759908d60f977a0f

    • SSDEEP

      12288:2y90VAHIaEd+rryjhkfJrszjTTT4erehqlniMVdUN0cRtbP1LBeSimdFf:2y9HqMrryjGavTTZqhqlPdUe4bVimdFf

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks