General

  • Target

    18df735af8fc13ff1cae170c10482cd2b2b124e70bbf30b10dbc3a627edfc293

  • Size

    1.8MB

  • Sample

    240523-fjvkgaed84

  • MD5

    e04b7b5ce521722e5ff8429c089899aa

  • SHA1

    65e8a8048871ccf44d32ec3dbaaa98985b9f9f09

  • SHA256

    18df735af8fc13ff1cae170c10482cd2b2b124e70bbf30b10dbc3a627edfc293

  • SHA512

    d4b55eb7414196510abb896b317d9f52dfe9f1e2fa8cc5414e040da8cfa162f545ae2dc40928cca1b01815e55f3b798f6fb3935f7d7c73abd61d5af5522b4a28

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO093OGi9JbBodjwC/hR:/3d5ZQ1NxJ+

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

    • Target

      18df735af8fc13ff1cae170c10482cd2b2b124e70bbf30b10dbc3a627edfc293

    • Size

      1.8MB

    • MD5

      e04b7b5ce521722e5ff8429c089899aa

    • SHA1

      65e8a8048871ccf44d32ec3dbaaa98985b9f9f09

    • SHA256

      18df735af8fc13ff1cae170c10482cd2b2b124e70bbf30b10dbc3a627edfc293

    • SHA512

      d4b55eb7414196510abb896b317d9f52dfe9f1e2fa8cc5414e040da8cfa162f545ae2dc40928cca1b01815e55f3b798f6fb3935f7d7c73abd61d5af5522b4a28

    • SSDEEP

      24576:/3vLRdVhZBK8NogWYO093OGi9JbBodjwC/hR:/3d5ZQ1NxJ+

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks