General

  • Target

    3d56e7fbbbe0b134c7c37f29eb08beaf

  • Size

    310KB

  • Sample

    240101-t17g9ageh9

  • MD5

    3d56e7fbbbe0b134c7c37f29eb08beaf

  • SHA1

    c6df464d50b233e4ba57093d2730048484cfbb3d

  • SHA256

    df5dc8fabcadc2401847ade809ff6a1e066d726b6821a981166fb60a8387da36

  • SHA512

    4ccf2a41b40dff60d59bf1805d7ba440c1b2a0617034f2ecdb49ce06eeb84e160ceb6fec645d76d9f34502c811bdc9de4eea9cbf20b5ab7e80d9f7d6c895c4e0

  • SSDEEP

    6144:kRoDoe+gNW187JCU11DE1gaiHDs8IObCMSJt2Fn0p8NmS/fwLhnby:kOoe9a87JF1I1gaiHDs8IObnSJgmS/4g

Malware Config

Targets

    • Target

      NNHK09090.exe

    • Size

      266KB

    • MD5

      c361fd420eaaf02d8d00849565dbe772

    • SHA1

      910c910c09e8fd3ecca9c44b0652ba05a295def8

    • SHA256

      4819be19d03a245b83fd593209f3ab072ca7d5491d60fea2d50b848236833088

    • SHA512

      50bf99f6cc71b47e21ac1718712d7aec7de839444e7985584a0fc9556a2ea9ec69e7eefd8ab33a86743dd34167f3401469ac22d698d5db7e418a18bddbe2db78

    • SSDEEP

      6144:GEVDew2jZVWwSAEyS+zc0jnKh7La0FBivyLEgM:G7vkwST+IWCnLqvypM

    • A310logger

      A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • A310logger Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks