Overview

overview

8

Static

static

1

ElementExe...B3.exe

windows11-21h2-x64

8

Resubmissions

03-07-2024 17:25

240703-vzm8na1hqa 8

28-06-2024 15:14

240628-smrzzavfme 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ElementB3.rar.rar

  • Size

    24.0MB

  • Sample

    240703-vzm8na1hqa

  • MD5

    3e788bea3d129ace10bedc2eb19c419f

  • SHA1

    6c36eef415051b2edce09e0dd7189dac27954f54

  • SHA256

    7ca136c1a31d64c78ccb1b1aa73011776ef555041f8bf75d3a1f3b0e8a1850d9

  • SHA512

    46d7a0fb337f5cc57f0dde6d74dcfa1c2f9bc6690831c42580282af5ed5ca10709f5fc68f7b1e54982e2ba5f40780acbf8b933ffe3a4f947c9612e42c7b538a8

  • SSDEEP

    786432:/brGxw4nHZuuqWSZiE8yddqqYENPgnh6YHNK:yw4HZuYzeoGPuQYtK

Score
8/10
defense_evasionexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      ElementExecuter/Element/ElementB3.exe

    • Size

      24.1MB

    • MD5

      2ba594a545371004bb4fea5cbb8bbe57

    • SHA1

      7c3465625cfa4d4a222ad63099d0084193f12fae

    • SHA256

      69ca1f26e0d34aea228ed37952cf42d5e80b5aef14ea98764c91a8d5e84ef8d4

    • SHA512

      3e776379b616db901d7562e72bce35e65ff0f8782d86e4f6902001341c816b84d0117b9458755943ffdd62a8f95f0f9c09b81ab525f0fcc770bd94a899044001

    • SSDEEP

      786432:s2xCRhWTRKLhwRfsfyPuesatj4+HRsuJTxmwen:qWYLhwqfyPgat/HNYFn

    Score
    8/10
    defense_evasionexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks