Overview

overview

10

Static

static

3

Untitled_J...df.exe

windows7-x64

7

Untitled_J...df.exe

windows10-2004-x64

7

[SYSTEM]/$UpCase.ps1

windows7-x64

3

[SYSTEM]/$UpCase.ps1

windows10-2004-x64

3

libcrypto-1_1-x64.dll

windows7-x64

10

libcrypto-1_1-x64.dll

windows10-2004-x64

10

vcruntime140.dll

windows7-x64

1

vcruntime140.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    document.pdf.vhd

  • Size

    20.0MB

  • Sample

    240703-whvf3ssfjb

  • MD5

    e004a8e64e2ea84f14932a6e1a1d66c1

  • SHA1

    b0dd61517b0234b83ad5f6127128b80ebe53a4cf

  • SHA256

    79d7036b030dcaaec258637b01dbc4f9786d6777afe85f6fe397d6034e2f4806

  • SHA512

    4b057be2e7b1b12b24378f606ca948101c83387d42ad6d91a2799b4771592eaa6c594b1b02616ee719c93d774507f8346bbef0b4d81616c686cdcc24a8b8bb29

  • SSDEEP

    98304:2s+uXh7LUq17TWdDFtEUx61CPwDv3uFfJx:2s+ch7pWdDFKUx61CPwDv3uFfJx

Score
10/10
metastealerdiscoveryexecutionspywarestealer

Malware Config

Extracted

Family

metastealer

C2

kiyaqoimsiieeyqa.xyz

ssqsmisuowqcwsqo.xyz

ykqmwgsuummieaug.xyz

ewukeskgqswqesiw.xyz

cscqcsgewmwwaaui.xyz

cyoksykiamiscyia.xyz

okgomokemoucqeso.xyz

ikwacuakiqeimwua.xyz

aawcsqqaywckiwmi.xyz

aiqasksgmyeqocei.xyz

qgumcuisgaeyuqqe.xyz

eiesoycamyqqgcea.xyz

ywceswakicsqomqw.xyz

auaieuewouawygku.xyz

cmiascusccywowcs.xyz

uiqkkomkaceqacec.xyz

quqeciymqmkqccqw.xyz

ssqsauuuyyigouou.xyz

aogaakukuugqswcy.xyz

ucgwcwsuqsuwewgc.xyz
Attributes
  • dga_seed

    21845

  • domain_length

    16

  • num_dga_domains

    10000

  • port

    443

Targets

    • Target

      Untitled_June_06_25_2024_export.pdf.pif

    • Size

      801KB

    • MD5

      41dcc29d7eaba7b84fd54323394712af

    • SHA1

      ddc0100723cc2dc9ae8b02a0cb7fe4a86c02d54b

    • SHA256

      a909bef708a47ae428fedbc566132c56f15ae7511dc460cf22055ec1a72d485a

    • SHA512

      5a3e8c1eda558e0b90470d752490bc4d04610f93e453cbfd9013a363cfdf5e607974d526c49efe2ef0440e241d775b66bd7c48c74ee9e8677a37cdedc30c42ee

    • SSDEEP

      6144:xmbuKA33X1rgMuu+xdaXkW+zF6m8XZPELSrPzA:x6XA33X1rTuuyrVZ6m8XGH

    Score
    7/10
    discovery

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

    • Target

      [SYSTEM]/$UpCase

    • Size

      128KB

    • MD5

      7ff498a44e45e77374cc7c962b1b92f2

    • SHA1

      5161a18e27b9ca9f5d04f2154576bf1ffb1121e8

    • SHA256

      41c26bc7a12bdaeb26025c93118697c7e3ef81ee048b00fe5cce2a472e0e0742

    • SHA512

      d76745c51900495acc56fead915650d32f940e8258ab672e369e92cc54e9d76a30611470e208e561ba80a920082d1d4dc28787a29d32521e65cf0dee8bd9bcb6

    • SSDEEP

      3072:e/pcGnh3vs/InbrTIHvPnHmC5irCuMo/+ncoZZihnhE:mrZn7y/EGuH/cpis

    Score
    3/10
    execution
    behavioral3behavioral4

    • Target

      libcrypto-1_1-x64.dll

    • Size

      2.1MB

    • MD5

      e37cf85193275925afdb82a266069174

    • SHA1

      8027ca74a08e02dc096a9a3f92081bd5a7a20c67

    • SHA256

      307ec11b5a2a83aa2787b8f3cbecb4ea93868a3b3982ebbd5392f3efe9141c78

    • SHA512

      16db460c1872711a9e84cbe60d587adf56750ff0720b50c992b749bf3f3e8f50d76af9976742aaf933bcded4ab663c6134dec8593b5d071af8eb0050f1285418

    • SSDEEP

      49152:onej4p8c8PFouXSgeAx7rRJHULSn17x95XsjRDFtEMawsusXxQ61CPwDv3uFfJ7:Ks+uXh7LUq17TWdDFtEUx61CPwDv3uFZ

    Score
    10/10
    metastealerdiscoveryexecutionspywarestealer

    • Meta Stealer

      Meta Stealer steals passwords stored in browsers, written in C++.

      stealermetastealer

    • MetaStealer payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      vcruntime140.dll

    • Size

      94KB

    • MD5

      5797d2a762227f35cdd581ec648693a8

    • SHA1

      e587b804db5e95833cbd2229af54c755ee0393b9

    • SHA256

      c51c64dfb7c445ecf0001f69c27e13299ddcfba0780efa72b866a7487b7491c7

    • SHA512

      5c4de4f65c0338f9a63b853db356175cae15c2ddc6b727f473726d69ee0d07545ac64b313c380548211216ea667caf32c5a0fd86f7abe75fc60086822bc4c92e

    • SSDEEP

      1536:yOHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1lLN:yOr/Z+jPYNV9H0Q8ecbjt1j

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks