Resubmissions

02-08-2024 20:51

240802-zm6lpazckr 9

02-08-2024 20:48

240802-zlhs8svbpb 9

02-08-2024 20:47

240802-zla4dsvbmh 8

02-08-2024 20:44

240802-zjfwvsvara 8

02-08-2024 20:44

240802-zh8kgszamp 8

02-08-2024 20:38

240802-zezheathne 8

General

  • Target

    https://cdn.discordapp.com/attachments/1266555940493332512/1268016318926295110/Bootstrapper.exe?ex=66ae2f79&is=66acddf9&hm=37c91d30dbc630d89da963cdb91c3348420b1eec132cd2da4405c224aa2d45eb&

  • Sample

    240802-zjfwvsvara

Score
8/10

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1266555940493332512/1268016318926295110/Bootstrapper.exe?ex=66ae2f79&is=66acddf9&hm=37c91d30dbc630d89da963cdb91c3348420b1eec132cd2da4405c224aa2d45eb&

    Score
    8/10
    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.