General

  • Target

    49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69.exe

  • Size

    1.9MB

  • Sample

    240104-y1lb8saean

  • MD5

    48cca537bfc1077877a1227b5d074868

  • SHA1

    6dfab03c599aabc5aff8b3c4e2836cc123b149e4

  • SHA256

    49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69

  • SHA512

    544da6e33c5e0402d754b6bd751f290d0d8106ffbde262eda4c55aed4bef3baf58cac3bd722c0df63d57c4b27f7aa8a8110de942c8dc4246ce730ceda1b26884

  • SSDEEP

    49152:WU5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:NE03yNFRbEMR5cea

Malware Config

Targets

    • Target

      49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69.exe

    • Size

      1.9MB

    • MD5

      48cca537bfc1077877a1227b5d074868

    • SHA1

      6dfab03c599aabc5aff8b3c4e2836cc123b149e4

    • SHA256

      49e2bff42b7cbe36126efe24979390bb0ed6028d9b42ae8160275dcab150ba69

    • SHA512

      544da6e33c5e0402d754b6bd751f290d0d8106ffbde262eda4c55aed4bef3baf58cac3bd722c0df63d57c4b27f7aa8a8110de942c8dc4246ce730ceda1b26884

    • SSDEEP

      49152:WU5z1o02R2cFNGLoygKtsbEMZV1rvX50VeV4mhQ:NE03yNFRbEMR5cea

    • Detected google phishing page

    • Modifies Windows Defender Real-time Protection settings

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks