General

  • Target

    Built.exe

  • Size

    7.6MB

  • Sample

    241110-tw2q7s1bmd

  • MD5

    abc8d0e898658cfd32592c03649be005

  • SHA1

    f2f77a51d3f68b11f99630693b226aebbb67af89

  • SHA256

    e326c75dd0ffe16dd3962110e77224b95097bff02c9c39c9132bbacecb44c64e

  • SHA512

    dd92a58a205df2c20be61f4f1fefd8d2a39ffa7cccb6a4faf045b774669225af96695dfddeed895c58bdeb05573a321bcaeaf121009b29206eab1abe9e751451

  • SSDEEP

    196608:+kHYKAwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jT:bIHziK1piXLGVE4Ue0VJ/

Malware Config

Targets

    • Target

      Built.exe

    • Size

      7.6MB

    • MD5

      abc8d0e898658cfd32592c03649be005

    • SHA1

      f2f77a51d3f68b11f99630693b226aebbb67af89

    • SHA256

      e326c75dd0ffe16dd3962110e77224b95097bff02c9c39c9132bbacecb44c64e

    • SHA512

      dd92a58a205df2c20be61f4f1fefd8d2a39ffa7cccb6a4faf045b774669225af96695dfddeed895c58bdeb05573a321bcaeaf121009b29206eab1abe9e751451

    • SSDEEP

      196608:+kHYKAwfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jT:bIHziK1piXLGVE4Ue0VJ/

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks