General

  • Target

    IDMan.exe

  • Size

    5.7MB

  • Sample

    240819-c226gszcna

  • MD5

    03204b0ed9a371157b611160794815e3

  • SHA1

    89da21c7c90bbd5e95eafb421eec3d89759ba94e

  • SHA256

    34523221a6e77eb82559860d1eeac03568b5778c66e103dfa275ceed4550d2ce

  • SHA512

    bfdce44f2782994d954de2e4a023d079fd8ff54cded4379a58a7faafe393daf41bf3ad4980624d058e0a5729e77b5ed83c6e45084accbfd13d33dfcbde17638e

  • SSDEEP

    98304:XjZAz1xe+yGfCdZZLP4lf18frP3wbzWFimaI7dloU3:XNd+/fCHsogbzWFimaI7dl

Malware Config

Targets

    • Target

      IDMan.exe

    • Size

      5.7MB

    • MD5

      03204b0ed9a371157b611160794815e3

    • SHA1

      89da21c7c90bbd5e95eafb421eec3d89759ba94e

    • SHA256

      34523221a6e77eb82559860d1eeac03568b5778c66e103dfa275ceed4550d2ce

    • SHA512

      bfdce44f2782994d954de2e4a023d079fd8ff54cded4379a58a7faafe393daf41bf3ad4980624d058e0a5729e77b5ed83c6e45084accbfd13d33dfcbde17638e

    • SSDEEP

      98304:XjZAz1xe+yGfCdZZLP4lf18frP3wbzWFimaI7dloU3:XNd+/fCHsogbzWFimaI7dl

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

MITRE ATT&CK Enterprise v15

Tasks