General

  • Target

    013cd9875062fc16e781885378e7dd1ef429689d14414ecec0b98fa2815729e5

  • Size

    7.9MB

  • Sample

    241108-1lwkrs1ajr

  • MD5

    1c8df79f8cf7d0474e8a57d70675f1ee

  • SHA1

    a7a763a92c58d67ab4d64c150c7cb25f7fe0c717

  • SHA256

    013cd9875062fc16e781885378e7dd1ef429689d14414ecec0b98fa2815729e5

  • SHA512

    d37d51f26a8ab619a43e3517a56344e0441f266734395e0a4e25730dad698ab64821f347fc4c0fbcf304ea3ee4bad247504ccdeceda122812c3cc9098549b89f

  • SSDEEP

    98304:g4NxK/6sZTj2Ry2fPA+yjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafv:g4meINTx9Pe20/zkOiu1f+79YR

Malware Config

Targets

    • Target

      013cd9875062fc16e781885378e7dd1ef429689d14414ecec0b98fa2815729e5

    • Size

      7.9MB

    • MD5

      1c8df79f8cf7d0474e8a57d70675f1ee

    • SHA1

      a7a763a92c58d67ab4d64c150c7cb25f7fe0c717

    • SHA256

      013cd9875062fc16e781885378e7dd1ef429689d14414ecec0b98fa2815729e5

    • SHA512

      d37d51f26a8ab619a43e3517a56344e0441f266734395e0a4e25730dad698ab64821f347fc4c0fbcf304ea3ee4bad247504ccdeceda122812c3cc9098549b89f

    • SSDEEP

      98304:g4NxK/6sZTj2Ry2fPA+yjNTEY9xFUkcVwNSHfbv/kOIhThw6Q1f+hl/hjY4+iafv:g4meINTx9Pe20/zkOiu1f+79YR

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks