General

  • Target

    1234.exe

  • Size

    597KB

  • Sample

    240522-yr9cpsee3w

  • MD5

    972bda48546cecc13e31bfc3d445e9f7

  • SHA1

    ef6e53d3b99c942df9c4751d93564d84b42748fc

  • SHA256

    45833dc7730d4f37357a4149eeb5cf1389c0a87df7ac5a5e52ad5a3ee845357a

  • SHA512

    2370ea4bd99f75f25cbfdd45fddaec5e2865dfae484e7fa014cc6b1a9a5f08afdfc48e29895463607a449f03c0615838d360c5652f7dab6b03ee2ac450434826

  • SSDEEP

    12288:4IRx6tD2PVle8zpYAgzvbiKoW+dDwm5sY:3RktDLAgT2KoVd0ZY

Malware Config

Targets

    • Target

      1234.exe

    • Size

      597KB

    • MD5

      972bda48546cecc13e31bfc3d445e9f7

    • SHA1

      ef6e53d3b99c942df9c4751d93564d84b42748fc

    • SHA256

      45833dc7730d4f37357a4149eeb5cf1389c0a87df7ac5a5e52ad5a3ee845357a

    • SHA512

      2370ea4bd99f75f25cbfdd45fddaec5e2865dfae484e7fa014cc6b1a9a5f08afdfc48e29895463607a449f03c0615838d360c5652f7dab6b03ee2ac450434826

    • SSDEEP

      12288:4IRx6tD2PVle8zpYAgzvbiKoW+dDwm5sY:3RktDLAgT2KoVd0ZY

    • Modifies WinLogon for persistence

    • Modifies AppInit DLL entries

    • Modifies Installed Components in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks