General
-
Target
DEPOSIT.exe
-
Size
10.9MB
-
Sample
240805-pnx1tszcmg
-
MD5
4aa395a0614d42ccc9c4b070a56c7343
-
SHA1
f322e79a773e39e9a70854bb01f582adfd9ef814
-
SHA256
8400250822bb5572a7e02dc8b60b63276bd4c109f2099ee9583a07e75f420b5f
-
SHA512
9e0d9b2aed621f78fcf6850421f2deb5f52595b54d443bf187f44bfc7d847372e2bbbf14f514ebd590123951abd2df018e1b99f92c09962ae6aec58dc4909b9c
-
SSDEEP
196608:vIrPMQkdwuLUhJb3tQk5tsurErvI9pWj+sgX3ZdahF0wB1AajVsCEk9QtQTNWVJg:6QOhh7v5tsurEUWj/gXe7b2C7S6gU
Behavioral task
behavioral1
Sample
DEPOSIT.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
DEPOSIT.exe
-
Size
10.9MB
-
MD5
4aa395a0614d42ccc9c4b070a56c7343
-
SHA1
f322e79a773e39e9a70854bb01f582adfd9ef814
-
SHA256
8400250822bb5572a7e02dc8b60b63276bd4c109f2099ee9583a07e75f420b5f
-
SHA512
9e0d9b2aed621f78fcf6850421f2deb5f52595b54d443bf187f44bfc7d847372e2bbbf14f514ebd590123951abd2df018e1b99f92c09962ae6aec58dc4909b9c
-
SSDEEP
196608:vIrPMQkdwuLUhJb3tQk5tsurErvI9pWj+sgX3ZdahF0wB1AajVsCEk9QtQTNWVJg:6QOhh7v5tsurEUWj/gXe7b2C7S6gU
-
Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Modifies Windows Firewall
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1System Information Discovery
3System Network Configuration Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1