Resubmissions

18-06-2024 13:04

240618-qa6w9ayfkk 7

General

  • Target

    https://cdn.discordapp.com/attachments/1187457258024599634/1251647268776316938/LeagueFVM.zip?ex=6672a29b&is=6671511b&hm=4bfd79c2f3f5e527e5cc173210fb39245caac26b9417f2da24b67c519d9fa1e4&

  • Sample

    240618-qa6w9ayfkk

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1187457258024599634/1251647268776316938/LeagueFVM.zip?ex=6672a29b&is=6671511b&hm=4bfd79c2f3f5e527e5cc173210fb39245caac26b9417f2da24b67c519d9fa1e4&

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Hide Artifacts: Hidden Files and Directories

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks