General

  • Target

    RuntimeBrokerVers.exe

  • Size

    13.1MB

  • Sample

    241113-hb7aeaxbpg

  • MD5

    ae312065fea9d2bb96daf340a2684e80

  • SHA1

    2a4db6fca345b56225ca3be9e95c33b97cabc212

  • SHA256

    7ba7384b9e549f4acd31b23cf4cd91db380899f8a517477e50d3087139322340

  • SHA512

    b0bc9fab62e36fcfa78148ddeb39762e5097cb5a922f1c07f45bcd523346be4c5646653d4ea3eaee9fabda104ebe17f4066cdf0f29fc72c1ce6cc23302d019c3

  • SSDEEP

    196608:s//oYEafIlN5XRmU8bKQqrB9fuFGb0nmxS/qbmI0B8w0nwBUHVLe3Sfxbwk3VKMh:YAF+OIU8bYfvS/NBp5+xbB3VKM4r2MZ

Malware Config

Targets

    • Target

      RuntimeBrokerVers.exe

    • Size

      13.1MB

    • MD5

      ae312065fea9d2bb96daf340a2684e80

    • SHA1

      2a4db6fca345b56225ca3be9e95c33b97cabc212

    • SHA256

      7ba7384b9e549f4acd31b23cf4cd91db380899f8a517477e50d3087139322340

    • SHA512

      b0bc9fab62e36fcfa78148ddeb39762e5097cb5a922f1c07f45bcd523346be4c5646653d4ea3eaee9fabda104ebe17f4066cdf0f29fc72c1ce6cc23302d019c3

    • SSDEEP

      196608:s//oYEafIlN5XRmU8bKQqrB9fuFGb0nmxS/qbmI0B8w0nwBUHVLe3Sfxbwk3VKMh:YAF+OIU8bYfvS/NBp5+xbB3VKM4r2MZ

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Exelastealer family

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks