General

  • Target

    noncontemptuously.exe

  • Size

    404KB

  • Sample

    240124-jld72sdca4

  • MD5

    729c57440e69f1255a83e16d8f29f182

  • SHA1

    653e1e252dac7dafcd7fb7d09b1f739ee906216b

  • SHA256

    e8b6c66f884a6d398bfd6e86ee4af88673a9e6f50767e195288c3bdafbaaa205

  • SHA512

    659dbe3b4aaa173a0a85614331327825056791475eb2235b936c7bd6c4211050077c1c9a0e3e2d11900a00956faf7f937d385db30af4f61f39769a0fceee3ee0

  • SSDEEP

    6144:h4t6Lsvq5WSBHoKC/Y3Y/kclNOmLNWnC8MwMLpXog6cjmSlJe:hkvqcSBHoKCAY/kclNOC4MQpcCoJ

Malware Config

Targets

    • Target

      noncontemptuously.exe

    • Size

      404KB

    • MD5

      729c57440e69f1255a83e16d8f29f182

    • SHA1

      653e1e252dac7dafcd7fb7d09b1f739ee906216b

    • SHA256

      e8b6c66f884a6d398bfd6e86ee4af88673a9e6f50767e195288c3bdafbaaa205

    • SHA512

      659dbe3b4aaa173a0a85614331327825056791475eb2235b936c7bd6c4211050077c1c9a0e3e2d11900a00956faf7f937d385db30af4f61f39769a0fceee3ee0

    • SSDEEP

      6144:h4t6Lsvq5WSBHoKC/Y3Y/kclNOmLNWnC8MwMLpXog6cjmSlJe:hkvqcSBHoKCAY/kclNOC4MQpcCoJ

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      17ed1c86bd67e78ade4712be48a7d2bd

    • SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

    • SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

    • SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

    • SSDEEP

      192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+

    Score
    3/10
    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      42b064366f780c1f298fa3cb3aeae260

    • SHA1

      5b0349db73c43f35227b252b9aa6555f5ede9015

    • SHA256

      c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab

    • SHA512

      50d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7

    • SSDEEP

      192:o68cSzvTyl4tgi8pPjQM0PuAg0YNyoIFtSP:LBSzm+t18pZ0WAg0RoIFg

    Score
    3/10
    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      b55f7f1b17c39018910c23108f929082

    • SHA1

      1601f1cc0d0d6bcf35799b7cd15550cd01556172

    • SHA256

      c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7

    • SHA512

      d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa

    • SSDEEP

      96:L7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkN538:RbGgGPzxeX6D8ZyGgmkN

    Score
    3/10
    • Target

      Ovicular/Subsidence/Ukyndigt/Dioceses/megapode.app

    • Size

      15KB

    • MD5

      6e941ea97a92ac8ee4ac713c354c58f6

    • SHA1

      3f23f03bf6547b2bf4b8a6eb00777a55aaf999ce

    • SHA256

      a3a45b243179f04a923e01a8f360aafa9d628b32354453f08c0b1c31797a534b

    • SHA512

      d2b43f6cf6d7e74c1053416213fcc35c30ca029c0c2f34de9553ad2adb92b923daf83611ba9b7b9d905ad1e60c53434dcd7ea58d3c0bf47ffa8b0e59b6cea489

    • SSDEEP

      384:U5FKcGSrXmxrPAn8EFGftXcMOxFILjA1BoLSw9QVN/Nr:IFUAYDEwftXcMkujKo6/Nr

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks