General
-
Target
Built.exe
-
Size
7.0MB
-
Sample
241112-rwxq5svcnb
-
MD5
94673f653706da9ebbd93580d287cc80
-
SHA1
9bfb2607d5da3d14b3b56c1aa2a7b65e1940dfa7
-
SHA256
8f41839c2a8a80984e95a7d8dd037f777aeebc72fc134ce4eb487b909f501603
-
SHA512
3a09df96d6434c53e925f9fc667ea896b49664c7e44e7b76a88460953b011450d3ebe3144296dac0f86412bbcdfbdc011178abf193c5f0b3524c1860b8a878ae
-
SSDEEP
98304:FyDjWM8JEE1FRamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzOyZkxIdfXeRpYRJJcGhEJ:Fy0yeNTfm/pf+xkqy3dWRpmrbW3jmr8
Static task
static1
Behavioral task
behavioral1
Sample
Built.exe
Resource
win10ltsc2021-20241023-en
Malware Config
Targets
-
-
Target
Built.exe
-
Size
7.0MB
-
MD5
94673f653706da9ebbd93580d287cc80
-
SHA1
9bfb2607d5da3d14b3b56c1aa2a7b65e1940dfa7
-
SHA256
8f41839c2a8a80984e95a7d8dd037f777aeebc72fc134ce4eb487b909f501603
-
SHA512
3a09df96d6434c53e925f9fc667ea896b49664c7e44e7b76a88460953b011450d3ebe3144296dac0f86412bbcdfbdc011178abf193c5f0b3524c1860b8a878ae
-
SSDEEP
98304:FyDjWM8JEE1FRamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzOyZkxIdfXeRpYRJJcGhEJ:Fy0yeNTfm/pf+xkqy3dWRpmrbW3jmr8
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3