General
-
Target
b3a2675b17036a98f828b6382022977fc01749fbfa9c56833e24e4dd11f719aa
-
Size
9.2MB
-
Sample
240801-2qy25azhlr
-
MD5
7082f16a01a962cad528b2fbe1837101
-
SHA1
9aa578dd1e0b096a540e4e87d0b6a916729365bf
-
SHA256
b3a2675b17036a98f828b6382022977fc01749fbfa9c56833e24e4dd11f719aa
-
SHA512
3406bb90c53de2d503b8958dce7dbaf84b329ee49f7a3ddc55a818800c75775ad05920ea055859f269d29c5c51cdbf0a11b76ad0f2160241dacd8984cffea8ef
-
SSDEEP
196608:woUQwuLQr6NA1HeT39IigJ1ncKOVVtgSE37ZZtQcNP+P:w/Vr6G1+TtIi00VlC/6Z
Behavioral task
behavioral1
Sample
b3a2675b17036a98f828b6382022977fc01749fbfa9c56833e24e4dd11f719aa.exe
Resource
win7-20240705-en
Malware Config
Targets
-
-
Target
b3a2675b17036a98f828b6382022977fc01749fbfa9c56833e24e4dd11f719aa
-
Size
9.2MB
-
MD5
7082f16a01a962cad528b2fbe1837101
-
SHA1
9aa578dd1e0b096a540e4e87d0b6a916729365bf
-
SHA256
b3a2675b17036a98f828b6382022977fc01749fbfa9c56833e24e4dd11f719aa
-
SHA512
3406bb90c53de2d503b8958dce7dbaf84b329ee49f7a3ddc55a818800c75775ad05920ea055859f269d29c5c51cdbf0a11b76ad0f2160241dacd8984cffea8ef
-
SSDEEP
196608:woUQwuLQr6NA1HeT39IigJ1ncKOVVtgSE37ZZtQcNP+P:w/Vr6G1+TtIi00VlC/6Z
-
SectopRAT payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Matrix ATT&CK v13
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2