Resubmissions

07-04-2024 19:19

240407-x1vegacd94 7

07-04-2024 18:59

240407-xm6wcabf2s 8

General

  • Target

    https://cdn.discordapp.com/attachments/1212717396331069512/1218700204971266078/mdj_cccdarib.exe?ex=66244d83&is=6611d883&hm=3317b9399919a2b0f44500b1b28956f4888abbc772e0ed90367a026c15a4d531&

  • Sample

    240407-x1vegacd94

Score
7/10

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1212717396331069512/1218700204971266078/mdj_cccdarib.exe?ex=66244d83&is=6611d883&hm=3317b9399919a2b0f44500b1b28956f4888abbc772e0ed90367a026c15a4d531&

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks