Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://cdn.discordapp.com/attachments/1299809565474422835/1300047698639982665/atom_steam.exe?ex=671f6b45&is=671e19c5&hm=901397100971fbbb6cec69b8a7ec49e8d41db2bc42a32bce050ffd09076ecffe&

  • Sample

    241027-mtyhfavjdn

Score
10/10
steamdiscoveryevasionexecutionpersistencephishingupx

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1299809565474422835/1300047698639982665/atom_steam.exe?ex=671f6b45&is=671e19c5&hm=901397100971fbbb6cec69b8a7ec49e8d41db2bc42a32bce050ffd09076ecffe&

    Score
    10/10
    steamdiscoveryevasionexecutionpersistencephishingupx

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Detected potential entity reuse from brand STEAM.

      phishingsteam

    • Enumerates processes with tasklist

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks