General

  • Target

    d8607ba6192f189ff0ffca6f21a1153b3ef4b540cf18353a6397a0b6ca563443N

  • Size

    2.3MB

  • Sample

    241109-yn636szpbt

  • MD5

    144dedd6fb0b36b89354df40f94c4350

  • SHA1

    ba0c41e9e90c52dafe452363ee14bf14815a85f9

  • SHA256

    d8607ba6192f189ff0ffca6f21a1153b3ef4b540cf18353a6397a0b6ca563443

  • SHA512

    598f344c93208ff1228150f8af12cd080cf9aa5ea3c061ce69103478b218f176207b8a27bd3b6fde4571f19c4e7d23a1e5fc7d83cc07d8a98f68353419e41c11

  • SSDEEP

    49152:1jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:1rkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Malware Config

Targets

    • Target

      d8607ba6192f189ff0ffca6f21a1153b3ef4b540cf18353a6397a0b6ca563443N

    • Size

      2.3MB

    • MD5

      144dedd6fb0b36b89354df40f94c4350

    • SHA1

      ba0c41e9e90c52dafe452363ee14bf14815a85f9

    • SHA256

      d8607ba6192f189ff0ffca6f21a1153b3ef4b540cf18353a6397a0b6ca563443

    • SHA512

      598f344c93208ff1228150f8af12cd080cf9aa5ea3c061ce69103478b218f176207b8a27bd3b6fde4571f19c4e7d23a1e5fc7d83cc07d8a98f68353419e41c11

    • SSDEEP

      49152:1jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:1rkI9rSjA5aDo73pzF2bz3p9y4HgIoov

    • Drops file in Drivers directory

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks