Overview

overview

9

Static

static

3

RoseExecutor.exe

windows7-x64

7

RoseExecutor.exe

windows10-2004-x64

9

ROSE-HWID.pyc

windows7-x64

3

ROSE-HWID.pyc

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    RoseExecutor.exe

  • Size

    19.2MB

  • Sample

    240811-a51eysxamp

  • MD5

    bd00d9148dd26326204ca285c5dd3bf9

  • SHA1

    8a61cbe32af2d71350a8ba88d01bd94b57e1432d

  • SHA256

    257b0e5ab76f1ed0016d4140c55d6081775aec746402069ccdcab72659773a42

  • SHA512

    0da9b5ae7c16e2f98f347ab0a86648967211218593363d6f20cc7fec033723bd384cb79f182d5bf6a01375a0c05828252efcf704f4353e5d76e670000101193d

  • SSDEEP

    393216:mnvgKQZvgPYVnNSMF1+TtIiFRCuARuAEFXms83qMq4jB6SbbcBsC:IjQxgPQH1QtIiCuAU/8ab4NBbbcBZ

Score
9/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealer

Malware Config

Targets

    • Target

      RoseExecutor.exe

    • Size

      19.2MB

    • MD5

      bd00d9148dd26326204ca285c5dd3bf9

    • SHA1

      8a61cbe32af2d71350a8ba88d01bd94b57e1432d

    • SHA256

      257b0e5ab76f1ed0016d4140c55d6081775aec746402069ccdcab72659773a42

    • SHA512

      0da9b5ae7c16e2f98f347ab0a86648967211218593363d6f20cc7fec033723bd384cb79f182d5bf6a01375a0c05828252efcf704f4353e5d76e670000101193d

    • SSDEEP

      393216:mnvgKQZvgPYVnNSMF1+TtIiFRCuARuAEFXms83qMq4jB6SbbcBsC:IjQxgPQH1QtIiCuAU/8ab4NBbbcBZ

    Score
    9/10
    discoverycredential_accessexecutionpersistenceprivilege_escalationspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      ROSE-HWID.pyc

    • Size

      49KB

    • MD5

      6ee89ff52288a360e6ac3e4e9c711095

    • SHA1

      5dbd2aa8d3ae4fe69a679c27c73b4d5c3109b1a2

    • SHA256

      40f978ec304b46e398ce2e049d41e682ef271620d976a08a9978348e0e284464

    • SHA512

      7657668ec7d460e6230d6318766d7595496b2f60f40908965237cad0cf53003d280eedc35b2f94fe937350de010884fcc49059d8824deec470013982b02725fa

    • SSDEEP

      1536:t9MWlRrCit3hAwn/12nYXrRorqRNc60DlhLxIUSgeC:jEit3quD9HNc6dUaC

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks