General

  • Target

    WexSide.exe

  • Size

    2.2MB

  • Sample

    240531-n7ah7sgh97

  • MD5

    185d2eb442c0f2c465ff5fc759621de6

  • SHA1

    fceed286074f22e85287570ffa735d5874c8a139

  • SHA256

    de88a6957905b06ffa24d512b148dd6fee45df029c676f1b0755fe0fa73ea871

  • SHA512

    b9b25092fea71f573ca8c42beb376e53d0b9b68bc208990ba726b9c7c935ee243b78cd5fb84ce854445abba9d54b2e59c04ead03f1f5eec28286f2501e85bdeb

  • SSDEEP

    49152:RFUvKLlr9rxyRciFlXKUusoNSAHWlCcHANKMY2Xj:RavGlrJxyRc2XKdSA2hnMY2Xj

Malware Config

Targets

    • Target

      WexSide.exe

    • Size

      2.2MB

    • MD5

      185d2eb442c0f2c465ff5fc759621de6

    • SHA1

      fceed286074f22e85287570ffa735d5874c8a139

    • SHA256

      de88a6957905b06ffa24d512b148dd6fee45df029c676f1b0755fe0fa73ea871

    • SHA512

      b9b25092fea71f573ca8c42beb376e53d0b9b68bc208990ba726b9c7c935ee243b78cd5fb84ce854445abba9d54b2e59c04ead03f1f5eec28286f2501e85bdeb

    • SSDEEP

      49152:RFUvKLlr9rxyRciFlXKUusoNSAHWlCcHANKMY2Xj:RavGlrJxyRc2XKdSA2hnMY2Xj

    • Detect Umbral payload

    • Modifies WinLogon for persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks