General

  • Target

    4ea3c7444f1d48a47ac16ad2c01486b4a9a178ee922f1fb29b4ed11b7aa586dc

  • Size

    75KB

  • Sample

    240614-z616bawfkb

  • MD5

    1128e7fdbd0545f8f38dfd14fc5d8f14

  • SHA1

    cdf58f3111f6e32c81aca466f24e213334b2613a

  • SHA256

    4ea3c7444f1d48a47ac16ad2c01486b4a9a178ee922f1fb29b4ed11b7aa586dc

  • SHA512

    c9ca5471f8a0a5e116b02f3875ebb7e1f4e5d5d6a9d2229a8b974ae42a79fd106ce449005b4bc93fabdda9d95d47b28e92f9b08eef98f9cbf1ba31ba5bc52039

  • SSDEEP

    1536:Ux1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3B:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPp

Malware Config

Targets

    • Target

      4ea3c7444f1d48a47ac16ad2c01486b4a9a178ee922f1fb29b4ed11b7aa586dc

    • Size

      75KB

    • MD5

      1128e7fdbd0545f8f38dfd14fc5d8f14

    • SHA1

      cdf58f3111f6e32c81aca466f24e213334b2613a

    • SHA256

      4ea3c7444f1d48a47ac16ad2c01486b4a9a178ee922f1fb29b4ed11b7aa586dc

    • SHA512

      c9ca5471f8a0a5e116b02f3875ebb7e1f4e5d5d6a9d2229a8b974ae42a79fd106ce449005b4bc93fabdda9d95d47b28e92f9b08eef98f9cbf1ba31ba5bc52039

    • SSDEEP

      1536:Ux1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3B:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPp

    • UPX dump on OEP (original entry point)

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks