Overview

overview

8

Static

static

1

RMTWEAKS_H...AK.bat

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RMTWEAKS_HIDDEN_BIOS_TWEAK.BAT

  • Size

    13.7MB

  • Sample

    240428-g3nrpshh53

  • MD5

    e344b5150dd89d3277e945c139c2ee30

  • SHA1

    19b9fe48427c2f7a8f0c643f68f7ceff50d1ebeb

  • SHA256

    cac28d2d9a9f4a13bb9a4d1ab20ef1a3800bb884a283af3e9095a00b9baf2cd5

  • SHA512

    6025bd3341d907d93804035d3fc16e6d38da765ee34e68dbfab1e3032578bc8fac2b0b5a5a48518b0a446771d7521e77f7639c38e4c45d1b99eb21a5d25cf08a

  • SSDEEP

    49152:GYmvGa3V+eLXwvjiLqAsnxYctN/vsoA05xhJPkjk/eh5Dx2IPMXDpqv8qBwZeRmq:K

Score
8/10
spywarestealer

Malware Config

Targets

    • Target

      RMTWEAKS_HIDDEN_BIOS_TWEAK.BAT

    • Size

      13.7MB

    • MD5

      e344b5150dd89d3277e945c139c2ee30

    • SHA1

      19b9fe48427c2f7a8f0c643f68f7ceff50d1ebeb

    • SHA256

      cac28d2d9a9f4a13bb9a4d1ab20ef1a3800bb884a283af3e9095a00b9baf2cd5

    • SHA512

      6025bd3341d907d93804035d3fc16e6d38da765ee34e68dbfab1e3032578bc8fac2b0b5a5a48518b0a446771d7521e77f7639c38e4c45d1b99eb21a5d25cf08a

    • SSDEEP

      49152:GYmvGa3V+eLXwvjiLqAsnxYctN/vsoA05xhJPkjk/eh5Dx2IPMXDpqv8qBwZeRmq:K

    Score
    8/10
    spywarestealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks