General
-
Target
ProtectPass.exe
-
Size
320KB
-
Sample
240814-x3wejszckb
-
MD5
d91ce8584e3ea4ab871df46a5691ad55
-
SHA1
1a8d835fc8b40731181b71a230837d71fc183e2f
-
SHA256
75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc
-
SHA512
2db75e9d2833a7bd086548f59cf1abc264b7a499382e09e343fa101b953fb390f64ff605e6cdc19423009332bc7cce4a6871f99c6404e6c49e7ecc5c337974ab
-
SSDEEP
6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvN:3m/Q6P8j/svm1TXI5tZB
Behavioral task
behavioral1
Sample
ProtectPass.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
ProtectPass.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
ProtectPass.exe
-
Size
320KB
-
MD5
d91ce8584e3ea4ab871df46a5691ad55
-
SHA1
1a8d835fc8b40731181b71a230837d71fc183e2f
-
SHA256
75bc18011ab2a39bdd97e241ee748399fa0fdf7fbd51a640abe5067cee34abcc
-
SHA512
2db75e9d2833a7bd086548f59cf1abc264b7a499382e09e343fa101b953fb390f64ff605e6cdc19423009332bc7cce4a6871f99c6404e6c49e7ecc5c337974ab
-
SSDEEP
6144:3m/Q1Q5Ng68j/svmHC40+XIzFUygWK0tWrcBOvN:3m/Q6P8j/svm1TXI5tZB
-
StormKitty payload
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2