General

  • Target

    Untitled design.png

  • Size

    260KB

  • Sample

    240502-thvqqsee26

  • MD5

    c3f77a6b72e7b3256b4510995ec055d2

  • SHA1

    934445bc5b3fe6ca5b54616aabc684af085d11fc

  • SHA256

    53395563fca0aab9c004ffc3393d7ca25acd736a28d9a9533d48400880863a61

  • SHA512

    bf275a8b571eba6f1f1384f823dc372216f3db92672f9b603cb2368efdd19d6bd7631eeed7980fdcb93d80604117d06194a01c6f3e1a508d05375eb979f09c55

  • SSDEEP

    6144:lhJru7w1U2sg0GbNnJOI85SWpQLtNwe62YHzbGa:lhVQw123GbNnJupQLt967n

Malware Config

Targets

    • Target

      Untitled design.png

    • Size

      260KB

    • MD5

      c3f77a6b72e7b3256b4510995ec055d2

    • SHA1

      934445bc5b3fe6ca5b54616aabc684af085d11fc

    • SHA256

      53395563fca0aab9c004ffc3393d7ca25acd736a28d9a9533d48400880863a61

    • SHA512

      bf275a8b571eba6f1f1384f823dc372216f3db92672f9b603cb2368efdd19d6bd7631eeed7980fdcb93d80604117d06194a01c6f3e1a508d05375eb979f09c55

    • SSDEEP

      6144:lhJru7w1U2sg0GbNnJOI85SWpQLtNwe62YHzbGa:lhVQw123GbNnJupQLt967n

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

    • Sets file execution options in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks