General

  • Target

    031d26192aeea01452c10be569e16f95007777176cc841cc97d75267c47991e6

  • Size

    483KB

  • Sample

    241112-xvt7hsxra1

  • MD5

    5c301f1e3cae1c79ac040fdc6af6f1b6

  • SHA1

    6fe1e7a49e985ef65bc1fafa946ad4f6ea64c3bc

  • SHA256

    031d26192aeea01452c10be569e16f95007777176cc841cc97d75267c47991e6

  • SHA512

    ae6456208c6660626501ac2c3d1d9cdf1be2c02c475bc43bb3b37b947710d291c213b7693e4402d8509c4e811ea886ace4a7a812617034c7fa462d92f6f38ce0

  • SSDEEP

    12288:AmCpLw+Z8BGLgUfxsSR1snpMEplLd1YuDbpi2+:TsLzZ8BmgUfxNqeQi2+

Malware Config

Targets

    • Target

      031d26192aeea01452c10be569e16f95007777176cc841cc97d75267c47991e6

    • Size

      483KB

    • MD5

      5c301f1e3cae1c79ac040fdc6af6f1b6

    • SHA1

      6fe1e7a49e985ef65bc1fafa946ad4f6ea64c3bc

    • SHA256

      031d26192aeea01452c10be569e16f95007777176cc841cc97d75267c47991e6

    • SHA512

      ae6456208c6660626501ac2c3d1d9cdf1be2c02c475bc43bb3b37b947710d291c213b7693e4402d8509c4e811ea886ace4a7a812617034c7fa462d92f6f38ce0

    • SSDEEP

      12288:AmCpLw+Z8BGLgUfxsSR1snpMEplLd1YuDbpi2+:TsLzZ8BmgUfxNqeQi2+

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Renames multiple (55) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks