General

  • Target

    bbe239290bee8915582ba8bef28968a5747311559aefab9f105189844e515756

  • Size

    409KB

  • Sample

    241110-f7mvjatmcq

  • MD5

    826e9ad0f74b25d0af95162996b649a2

  • SHA1

    469b413d2f3ab3bf7124cdeb8988541f9342d547

  • SHA256

    bbe239290bee8915582ba8bef28968a5747311559aefab9f105189844e515756

  • SHA512

    1e81d53df0b30585c2a732d5f934d0f1ea5832cf240b3c659b64fa7ca5fa40bb8df9d66675df262305b99858dee0f86f3c2309abe8230bd3215c73fa19d4dbd4

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse

Malware Config

Targets

    • Target

      bbe239290bee8915582ba8bef28968a5747311559aefab9f105189844e515756

    • Size

      409KB

    • MD5

      826e9ad0f74b25d0af95162996b649a2

    • SHA1

      469b413d2f3ab3bf7124cdeb8988541f9342d547

    • SHA256

      bbe239290bee8915582ba8bef28968a5747311559aefab9f105189844e515756

    • SHA512

      1e81d53df0b30585c2a732d5f934d0f1ea5832cf240b3c659b64fa7ca5fa40bb8df9d66675df262305b99858dee0f86f3c2309abe8230bd3215c73fa19d4dbd4

    • SSDEEP

      6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse

    • Blocklisted process makes network request

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks