General

  • Target

    26ce372c727dcabba7231fe10b38556be2874bf9f2697b5c50c2302098499d43

  • Size

    1.8MB

  • Sample

    240619-gd1d7szbml

  • MD5

    883f03189f3216d2e7325d40347171ca

  • SHA1

    55dc7c81b8f27d07f34628748a3d511cf38fa04d

  • SHA256

    26ce372c727dcabba7231fe10b38556be2874bf9f2697b5c50c2302098499d43

  • SHA512

    f5ef86e99fab78315a52c15218c4347a8eb31354c4b5ead8025e8f699fe0a156d7d172ddb42220182547f963ba666bc0af2c33ed291ef2b483f037be0c6a3d77

  • SSDEEP

    24576:/3vLRdVhZBK8NogWYO09XOGi93bBodjwC/hR:/3d5ZQ15x3+

Malware Config

Extracted

Family

metasploit

Version

windows/shell_reverse_tcp

C2

1.15.12.73:4567

Targets

    • Target

      26ce372c727dcabba7231fe10b38556be2874bf9f2697b5c50c2302098499d43

    • Size

      1.8MB

    • MD5

      883f03189f3216d2e7325d40347171ca

    • SHA1

      55dc7c81b8f27d07f34628748a3d511cf38fa04d

    • SHA256

      26ce372c727dcabba7231fe10b38556be2874bf9f2697b5c50c2302098499d43

    • SHA512

      f5ef86e99fab78315a52c15218c4347a8eb31354c4b5ead8025e8f699fe0a156d7d172ddb42220182547f963ba666bc0af2c33ed291ef2b483f037be0c6a3d77

    • SSDEEP

      24576:/3vLRdVhZBK8NogWYO09XOGi93bBodjwC/hR:/3d5ZQ15x3+

    • MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Tasks