General
-
Target
Google Chrome.exe
-
Size
165.5MB
-
Sample
240526-l66h5sfc99
-
MD5
17decaf6c504ccd48733a99c082a0371
-
SHA1
888f60ab988a40ac9b66f868de708bf7fdddc8c6
-
SHA256
aec21e789d72c471183f2c43a87632110c7c10c9762d53e19994c8ab3e558479
-
SHA512
9ed7a6674abee933c409d0465ef42de189595eeec8381b8364e5e8b3be7d398d1df89e260deba589a8e121ccdf29f94ecaaee502d2ce6948645ad945a1d50da0
-
SSDEEP
3145728:PGljfMBjDxz2K+2yXvdlOuAbUHesRlgpAr2BhD4E4QzTXD:uJM5Dxz2Tt1lFeUHe0Sp9J4S
Static task
static1
Behavioral task
behavioral1
Sample
Google Chrome.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Google Chrome.exe
Resource
win10v2004-20240426-en
Malware Config
Targets
-
-
Target
Google Chrome.exe
-
Size
165.5MB
-
MD5
17decaf6c504ccd48733a99c082a0371
-
SHA1
888f60ab988a40ac9b66f868de708bf7fdddc8c6
-
SHA256
aec21e789d72c471183f2c43a87632110c7c10c9762d53e19994c8ab3e558479
-
SHA512
9ed7a6674abee933c409d0465ef42de189595eeec8381b8364e5e8b3be7d398d1df89e260deba589a8e121ccdf29f94ecaaee502d2ce6948645ad945a1d50da0
-
SSDEEP
3145728:PGljfMBjDxz2K+2yXvdlOuAbUHesRlgpAr2BhD4E4QzTXD:uJM5Dxz2Tt1lFeUHe0Sp9J4S
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
1Hide Artifacts
1Hidden Files and Directories
1