General

  • Target

    Start.exe

  • Size

    37.6MB

  • Sample

    240509-mebecsfe26

  • MD5

    2ddc35c140fbb180b9ef8f9c3919b35a

  • SHA1

    24f39a775725c4d198d4af45d109a9262a13dd9a

  • SHA256

    e6dd8ab3bc1cd4facba0a3c4e98abe0acbe88f52457e709e1f57935662ec5c59

  • SHA512

    02c645f72752148929ad5c4ef546956b0d5839949940976f9b3d6bbd5f73840edc840845f29018e8488b3550469f5f4e57671502661245d26cc80cccffe28463

  • SSDEEP

    393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg296l+ZArYsFRldj5:R3on1HvSzxAMN2FZArYsVjPvQ7OZ06j

Malware Config

Targets

    • Target

      Start.exe

    • Size

      37.6MB

    • MD5

      2ddc35c140fbb180b9ef8f9c3919b35a

    • SHA1

      24f39a775725c4d198d4af45d109a9262a13dd9a

    • SHA256

      e6dd8ab3bc1cd4facba0a3c4e98abe0acbe88f52457e709e1f57935662ec5c59

    • SHA512

      02c645f72752148929ad5c4ef546956b0d5839949940976f9b3d6bbd5f73840edc840845f29018e8488b3550469f5f4e57671502661245d26cc80cccffe28463

    • SSDEEP

      393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mg296l+ZArYsFRldj5:R3on1HvSzxAMN2FZArYsVjPvQ7OZ06j

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks