General

  • Target

    IDMan.exe

  • Size

    5.7MB

  • Sample

    240426-ctsxvahc5w

  • MD5

    b8d3b006f75fe1678e9ba9f8cc65d109

  • SHA1

    198657d791c262a80c499c2b73e9a08ca6f341f2

  • SHA256

    07ff7a204fdafe4994d146a1493282cb96f69090e9bc337adb3176b5f39b4c16

  • SHA512

    42bbf6493d9c1e59fb7ccb4116f28fb2b1dafdfbd01075ef3d02935d2f543a1a21126f47ee2201bb9462c3fae3afdfc8b962072a26e180b3d8e0085d370ac6c5

  • SSDEEP

    98304:Wn4fMJBeiJ9a3N8rP4S18frP3wbzWFimaI7dlo+:WPBeiJ9ad9gbzWFimaI7dl3

Malware Config

Targets

    • Target

      IDMan.exe

    • Size

      5.7MB

    • MD5

      b8d3b006f75fe1678e9ba9f8cc65d109

    • SHA1

      198657d791c262a80c499c2b73e9a08ca6f341f2

    • SHA256

      07ff7a204fdafe4994d146a1493282cb96f69090e9bc337adb3176b5f39b4c16

    • SHA512

      42bbf6493d9c1e59fb7ccb4116f28fb2b1dafdfbd01075ef3d02935d2f543a1a21126f47ee2201bb9462c3fae3afdfc8b962072a26e180b3d8e0085d370ac6c5

    • SSDEEP

      98304:Wn4fMJBeiJ9a3N8rP4S18frP3wbzWFimaI7dlo+:WPBeiJ9ad9gbzWFimaI7dl3

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Collection

Data from Local System

1
T1005

Tasks