General
- Target https://cdn.discordapp.com/attachments/1000572518157009029/1200543435438968852/PAP46E1UkZ.exe?ex=65c69034&is=65b41b34&hm=a7649010ab93b66cee433f058c3107f23cfc452eb5ea2c0d895eaa6cd112a53a&
- Sample240127-rgpf8adgc5
Score
10/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1000572518157009029/1200543435438968852/PAP46E1UkZ.exe?ex=65c69034&is=65b41b34&hm=a7649010ab93b66cee433f058c3107f23cfc452eb5ea2c0d895eaa6cd112a53a&
Score10/10Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Blocklisted process makes network request
Downloads MZ/PE file
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.