11187b50a7a8f212a22781d5a93b84fd7ecce32c3edaa3a04d581c943ddcd894

General

Target

Mineral.exe
Size

367KB
MD5

60847eef908d4c371a64d58efeb80f2f
SHA1

1587b41a9c28a3d52923c2cb6f395d2487ecbf38
SHA256

1665090883b9e3aa77b433bd241c4aa97290f3f8591e8d69cabe3b70bb3f2256
SHA512

82c18aa0bdeba0d15db8c11182b8992c4cab631c362a8270a9bab80cece69d80d42dfd8ce18bedb3dca711801750a25ec23cbbcd191d7e4abe90cda6fc7b036a
SSDEEP

6144:LapTuicHTfnb2e3kPZrHd/9OvTMqgjzIFgikmVZtmFs/t4pJzf9x7jL9FOwSvAN:LkuicHTfnb2eyZrH/SgukmtmFs/sJf95

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2072 set thread context of 2428	2072	Mineral.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mineral.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mineral.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2704	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	Mineral.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2072 wrote to memory of 2428	2072	Mineral.exe	30
PID 2428 wrote to memory of 2704	2428	Mineral.exe	31
PID 2428 wrote to memory of 2704	2428	Mineral.exe	31
PID 2428 wrote to memory of 2704	2428	Mineral.exe	31
PID 2428 wrote to memory of 2704	2428	Mineral.exe	31

C:\Users\Admin\AppData\Local\Temp\Mineral.exe
"C:\Users\Admin\AppData\Local\Temp\Mineral.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\Mineral.exe
  C:\Users\Admin\AppData\Local\Temp\Mineral.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\tz.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Opens file in notepad (likely ransom note)
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

4

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\tz.txt

Filesize
1KB

MD5
43b74d7907aa3c1fe4b66036524db6b4

SHA1
4edc48dff0a3e3b0cc2a15c35d4ca11d29be611d

SHA256
ba321335a92987133d1e69d6a8fb73fe2accd6f4f2b414a714cbb63df51f0cd7

SHA512
0059e16aac1ac7378c7da20d08b38d83df9216f158017c00c24ecfad053fd805124eb7d58a0a917feb480b70037dd7c02e4ce43bdb5a9e0480ab460c409f91d1

Download Submit
memory/2072-11-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2072-1-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/2072-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/2428-13-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2428-10-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2428-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2428-6-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2428-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2428-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2428-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2428-2-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing