General

  • Target

    idman642build23.exe

  • Size

    11.7MB

  • Sample

    241110-tq323s1amf

  • MD5

    1d4170878199111b6398a5a1d476e272

  • SHA1

    bc7dcf056b6be9aa7f3ee9922d08ad3ccf9b39ad

  • SHA256

    dd0d8aa84d52d176ed315c24ef0ca96134367da12488eff4abd85f098521b9f0

  • SHA512

    42353a26afd051cc9865e90e532f1c217f520f6a90ce74ef1e428c619d42559265a91cfa61aa7a9f32209cf47a7e0fefdc227a217dd3160d58cb8b745019d6b8

  • SSDEEP

    196608:CP5p3d3Z+7sqy0MEYOI18oNWeNTn9zU2HNZ4d+rOFfVDbZjh4SnzD2pe85DCkpjZ:Ufp+7zMJO+Z/ZNtZKkOLnZ1zKpj9CkVZ

Malware Config

Targets

    • Target

      idman642build23.exe

    • Size

      11.7MB

    • MD5

      1d4170878199111b6398a5a1d476e272

    • SHA1

      bc7dcf056b6be9aa7f3ee9922d08ad3ccf9b39ad

    • SHA256

      dd0d8aa84d52d176ed315c24ef0ca96134367da12488eff4abd85f098521b9f0

    • SHA512

      42353a26afd051cc9865e90e532f1c217f520f6a90ce74ef1e428c619d42559265a91cfa61aa7a9f32209cf47a7e0fefdc227a217dd3160d58cb8b745019d6b8

    • SSDEEP

      196608:CP5p3d3Z+7sqy0MEYOI18oNWeNTn9zU2HNZ4d+rOFfVDbZjh4SnzD2pe85DCkpjZ:Ufp+7zMJO+Z/ZNtZKkOLnZ1zKpj9CkVZ

    • Drops file in Drivers directory

    • A potential corporate email address has been identified in the URL: [email protected]

    • Adds Run key to start application

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

MITRE ATT&CK Enterprise v15

Tasks