General
-
Target
7ea99740a913fd01ab5b6d630a65f501.bin
-
Size
27.6MB
-
Sample
240904-b346sstfqc
-
MD5
58c3089e979bc1c7acaf08723e9792ad
-
SHA1
c1458aff50297f0257b8a3bde71c9c93da647725
-
SHA256
cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c
-
SHA512
2a646ae632608aa2fd66860f0fdb99a867d1feb3dcdf37df7214d1c2e31eb5d2ab32477de8dccdbafbc5fa9368c8a2b461e973a2fbc22f7fcb8769c1a27b82ed
-
SSDEEP
786432:NVIU4riHYYNy6nFeIQRGR97mMtwnsNGn2D8DtGeYkOXrt:NKU8iHA6nVQRGX7mMtwsAU2IXt
Behavioral task
behavioral1
Sample
7ea99740a913fd01ab5b6d630a65f501.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe
Resource
win11-20240802-en
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-
https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take
Targets
-
-
Target
7ea99740a913fd01ab5b6d630a65f501.bin
-
Size
27.6MB
-
MD5
58c3089e979bc1c7acaf08723e9792ad
-
SHA1
c1458aff50297f0257b8a3bde71c9c93da647725
-
SHA256
cf15cbbd2d202606139eff015c2be74c70eb0606aeb89469a07382481188c86c
-
SHA512
2a646ae632608aa2fd66860f0fdb99a867d1feb3dcdf37df7214d1c2e31eb5d2ab32477de8dccdbafbc5fa9368c8a2b461e973a2fbc22f7fcb8769c1a27b82ed
-
SSDEEP
786432:NVIU4riHYYNy6nFeIQRGR97mMtwnsNGn2D8DtGeYkOXrt:NKU8iHA6nVQRGX7mMtwsAU2IXt
Score1/10 -
-
-
Target
06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314.exe
-
Size
27.8MB
-
MD5
7ea99740a913fd01ab5b6d630a65f501
-
SHA1
fe11a17c1a403d6df28508d576c76ece07cce88b
-
SHA256
06d1a9fd3099cfb0cc829db930ab25f75a532e5e670e1704844cf7b1000d6314
-
SHA512
29f0f688d920bccc887f70710c3b6b01dd004dbef0c294bc57a46d7c460dc979ddb08a8d3c21df26510cbe3c380dc17dcc43e4fa86dc9d56dd4ff17de2280953
-
SSDEEP
393216:CUrTbCVFENlgdkQbaVxN2dAdpN7D9aJtW9dcGMBD2KSedViDKKeLQOshouIkPFt4:CUvRgdjtAd99dfGV6qLxwouZtRL
-
Modifies WinLogon for persistence
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Indicator Removal: Clear Windows Event Logs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Indicator Removal
1Clear Windows Event Logs
1Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1