1b508da7860673586002b0c6bc8ac5f29ce72504c96bc6a162930a09538ff78c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b508da7860673586002b0c6bc8ac5f29ce72504c96bc6a162930a09538ff78c.exe
Size

823KB
Sample

240905-kgnflaxejf
MD5

9d3f1ed5687b8053480f20f349ee3ddf
SHA1

c8933a9a42a419340f104d7e6ad593e00e7165ea
SHA256

1b508da7860673586002b0c6bc8ac5f29ce72504c96bc6a162930a09538ff78c
SHA512

e03312316a2dac3f58abdaae93e3314328fb1cc5859aad5dc2e6baff2254cb439c6e7fe71338ec39a7f54f48d48ba6a1c2908b5ac82ac61ca4523afd2778a18a
SSDEEP

12288:0DpDYP+TKs4EO1LyYppS3NiPnWy0v3Rtl:sl3KN1Qdi8Hl

Score

9^/10

collection credential_access discovery persistence privilege_escalation stealer

Malware Config

Targets

- Target
  
  1b508da7860673586002b0c6bc8ac5f29ce72504c96bc6a162930a09538ff78c.exe
- Size
  
  823KB
- MD5
  
  9d3f1ed5687b8053480f20f349ee3ddf
- SHA1
  
  c8933a9a42a419340f104d7e6ad593e00e7165ea
- SHA256
  
  1b508da7860673586002b0c6bc8ac5f29ce72504c96bc6a162930a09538ff78c
- SHA512
  
  e03312316a2dac3f58abdaae93e3314328fb1cc5859aad5dc2e6baff2254cb439c6e7fe71338ec39a7f54f48d48ba6a1c2908b5ac82ac61ca4523afd2778a18a
- SSDEEP
  
  12288:0DpDYP+TKs4EO1LyYppS3NiPnWy0v3Rtl:sl3KN1Qdi8Hl
Score

9^/10

discovery collection credential_access persistence privilege_escalation stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Browser Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

collectioncredential_accessdiscoverypersistenceprivilege_escalationstealer