General

  • Target

    c4ad96e3cfa611fa75633fab8eb5cd7edf6fa091e2a6c035b0d63c2bff0adb1a

  • Size

    410KB

  • Sample

    240822-stsvvawhrn

  • MD5

    f4994400fd5b59d4db14f1f862237bcd

  • SHA1

    91f179c43d2503acce3e8472e7899be2f4f43c1c

  • SHA256

    c4ad96e3cfa611fa75633fab8eb5cd7edf6fa091e2a6c035b0d63c2bff0adb1a

  • SHA512

    61494414a96f0a72026cb3eb9a0f85d49dbb7a73f63b344b635dd7af13bcda4af476525cd2a74ca439c159fbfc030c52a184e4088ab585f48278fc76fe691a90

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4K:gtRfJcNYFNm8UhlZGseK

Malware Config

Targets

    • Target

      c4ad96e3cfa611fa75633fab8eb5cd7edf6fa091e2a6c035b0d63c2bff0adb1a

    • Size

      410KB

    • MD5

      f4994400fd5b59d4db14f1f862237bcd

    • SHA1

      91f179c43d2503acce3e8472e7899be2f4f43c1c

    • SHA256

      c4ad96e3cfa611fa75633fab8eb5cd7edf6fa091e2a6c035b0d63c2bff0adb1a

    • SHA512

      61494414a96f0a72026cb3eb9a0f85d49dbb7a73f63b344b635dd7af13bcda4af476525cd2a74ca439c159fbfc030c52a184e4088ab585f48278fc76fe691a90

    • SSDEEP

      6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4K:gtRfJcNYFNm8UhlZGseK

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks