General
- Target DaMonksPrivLoggerGun (1).dll
- Size 8KB
- Sample240926-bh4pjayapj
- SHA256 40d9d162b7a66af6d0e981cd2b49260ebd0d4b338363b6facf89a5cd6cba5b87
Score
8/10
Malware Config
Targets
-
- Target DaMonksPrivLoggerGun (1).dll
- Size 8KB
- SHA256 40d9d162b7a66af6d0e981cd2b49260ebd0d4b338363b6facf89a5cd6cba5b87
Score8/10Downloads MZ/PE file
Possible privilege escalation attempt
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1