3dbe1bdb5c1016dc74669a0d0736c3f0922f5a0d35e621da592a9164391454f3

General

Target

3dbe1bdb5c1016dc74669a0d0736c3f0922f5a0d35e621da592a9164391454f3.hta
Size

152KB
Sample

240808-sz7k7avhjp
MD5

c79008b7f0630a2a71671472013e0361
SHA1

7b44cf3550f7a1e5930d1994abeaaa3859178612
SHA256

3dbe1bdb5c1016dc74669a0d0736c3f0922f5a0d35e621da592a9164391454f3
SHA512

07b6b9bccffa2929d16306800b566bc49218038954130e6dbffe8961c148635e0c604d3f1e9f5f4fd94142a5a8987d5a55b6babc8cab490391691715b3175a79
SSDEEP

768:tZ6A3yXNA0AGAA3AR7xPO+vg0MroyLKQlxvQiXAZO:tBlo/rn5

Score

9^/10

Malware Config

Targets

- Target
  
  3dbe1bdb5c1016dc74669a0d0736c3f0922f5a0d35e621da592a9164391454f3.hta
- Size
  
  152KB
- MD5
  
  c79008b7f0630a2a71671472013e0361
- SHA1
  
  7b44cf3550f7a1e5930d1994abeaaa3859178612
- SHA256
  
  3dbe1bdb5c1016dc74669a0d0736c3f0922f5a0d35e621da592a9164391454f3
- SHA512
  
  07b6b9bccffa2929d16306800b566bc49218038954130e6dbffe8961c148635e0c604d3f1e9f5f4fd94142a5a8987d5a55b6babc8cab490391691715b3175a79
- SSDEEP
  
  768:tZ6A3yXNA0AGAA3AR7xPO+vg0MroyLKQlxvQiXAZO:tBlo/rn5
Score

9^/10

collection credential_access defense_evasion discovery execution spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Evasion via Device Credential Deployment
  defense_evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2