Overview

overview

10

Static

static

3

2024-08-09...er.exe

windows7-x64

10

2024-08-09...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-08-09_125b5d666869a3215657fd00fbd655e8_cobalt-strike_medusa-locker

  • Size

    600KB

  • Sample

    240809-3c5s7aydld

  • MD5

    125b5d666869a3215657fd00fbd655e8

  • SHA1

    e2f3f18600276875e74c2c55eb50407893d00c9d

  • SHA256

    6171e04c5eb7ea76b7ed6f1b990fca06fa2a4a62191658a4fccd5b5c750a6c7a

  • SHA512

    5895c932ee95c27e02ca2274d1516f06c4954e722ac582cd7eb95a4cd5e6afcaaedd8199abf39cb3b7c08fc2360170be28a0135ede08d5d7e81f379a258f4fca

  • SSDEEP

    12288:jMPnSbgwPCw4sLBaOcMFgewRNQ2ufQumS+7WG7fYWbpTD:e0HPCw4sLBaOcM2ep1fQumkIfDT

Score
10/10
credential_accessdiscoveryevasionspywarestealertrojan

Malware Config

Targets

    • Target

      2024-08-09_125b5d666869a3215657fd00fbd655e8_cobalt-strike_medusa-locker

    • Size

      600KB

    • MD5

      125b5d666869a3215657fd00fbd655e8

    • SHA1

      e2f3f18600276875e74c2c55eb50407893d00c9d

    • SHA256

      6171e04c5eb7ea76b7ed6f1b990fca06fa2a4a62191658a4fccd5b5c750a6c7a

    • SHA512

      5895c932ee95c27e02ca2274d1516f06c4954e722ac582cd7eb95a4cd5e6afcaaedd8199abf39cb3b7c08fc2360170be28a0135ede08d5d7e81f379a258f4fca

    • SSDEEP

      12288:jMPnSbgwPCw4sLBaOcMFgewRNQ2ufQumS+7WG7fYWbpTD:e0HPCw4sLBaOcM2ep1fQumkIfDT

    Score
    10/10
    credential_accessdiscoveryevasionspywarestealertrojan

    • UAC bypass

      evasiontrojan

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks