General

  • Target

    46cc1157f7333d7473e18467dfdad3ff.exe

  • Size

    10.7MB

  • Sample

    240515-nqkmvafd7v

  • MD5

    46cc1157f7333d7473e18467dfdad3ff

  • SHA1

    2b962692c1ff004b5a48d9f4d697b3c293095b27

  • SHA256

    614ca907b16795bc293bf411af21b955c0ea47583dd4a5c659f7e00637d26b3c

  • SHA512

    484326b404f75156c75aed68db74a5e331955cca509f0c73c77652f0b6f40dc9a8573ffaeb69c9e96a549b36664226aeead3bed4692a3002acdbe6b8df541921

  • SSDEEP

    196608:JJTgBp37/NHq8B29LJEKWzJhRWY6Z0sU+FNuQ4zOZ+1ak3Yzb5:J1kFNHo+1bWYwUaMrz5aP/

Malware Config

Targets

    • Target

      46cc1157f7333d7473e18467dfdad3ff.exe

    • Size

      10.7MB

    • MD5

      46cc1157f7333d7473e18467dfdad3ff

    • SHA1

      2b962692c1ff004b5a48d9f4d697b3c293095b27

    • SHA256

      614ca907b16795bc293bf411af21b955c0ea47583dd4a5c659f7e00637d26b3c

    • SHA512

      484326b404f75156c75aed68db74a5e331955cca509f0c73c77652f0b6f40dc9a8573ffaeb69c9e96a549b36664226aeead3bed4692a3002acdbe6b8df541921

    • SSDEEP

      196608:JJTgBp37/NHq8B29LJEKWzJhRWY6Z0sU+FNuQ4zOZ+1ak3Yzb5:J1kFNHo+1bWYwUaMrz5aP/

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks