Overview

overview

10

Static

static

3

ORDER REF ...CO.exe

windows7-x64

10

ORDER REF ...CO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ORDER REF 47806798 PSMCO.exe

  • Size

    1.0MB

  • Sample

    241031-lcpnjawckk

  • MD5

    0c30c6e44c595afef7d8e5209e6c21cd

  • SHA1

    9ad384a291bcb187a770826c9b4524ded9d4ce33

  • SHA256

    76af8cf5846c6addfc9049cde063bbee8c0353bc0870c5080ad37a41a9aab1a3

  • SHA512

    2ecd6746865cb88457f3e60445fbb5a790a9df84ca1d00acdd5124eea986e17e61d2dbe6b236d7b40691c7ff3a2f473508bb7b4299575b14b6124e64b905d543

  • SSDEEP

    24576:ZVb5KPAdOzVmG3zd+eIDT8Jf3pbV13Jks:ZVhOhd+eI8t5X

Score
10/10
modiloaderstormkittyxwormdiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      ORDER REF 47806798 PSMCO.exe

    • Size

      1.0MB

    • MD5

      0c30c6e44c595afef7d8e5209e6c21cd

    • SHA1

      9ad384a291bcb187a770826c9b4524ded9d4ce33

    • SHA256

      76af8cf5846c6addfc9049cde063bbee8c0353bc0870c5080ad37a41a9aab1a3

    • SHA512

      2ecd6746865cb88457f3e60445fbb5a790a9df84ca1d00acdd5124eea986e17e61d2dbe6b236d7b40691c7ff3a2f473508bb7b4299575b14b6124e64b905d543

    • SSDEEP

      24576:ZVb5KPAdOzVmG3zd+eIDT8Jf3pbV13Jks:ZVhOhd+eI8t5X

    Score
    10/10
    modiloaderdiscoverytrojanstormkittyxwormexecutionpersistenceratspywarestealer

    • Detect Xworm Payload

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modiloader family

      modiloader

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Stormkitty family

      stormkitty

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • ModiLoader Second Stage

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks