General
-
Target
http://scan-echo.online/client/PAP46E1UkZ.exe
-
Sample
240626-myzw3a1eph
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://scan-echo.online/client/PAP46E1UkZ.exe
Resource
win11-20240419-en
27 signatures
150 seconds
Malware Config
Targets
-
-
Target
http://scan-echo.online/client/PAP46E1UkZ.exe
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1