General

  • Target

    beca642671cd38cc9309f76ebb9f10ba80205290f285f5c2a80aa0ed09f22179.exe

  • Size

    86KB

  • Sample

    241113-rrcv6stcmb

  • MD5

    e37f06b0c7d88f4a8c186811a1079e4b

  • SHA1

    6a817e7234f3bdc125147d9771a847d827bb9f95

  • SHA256

    beca642671cd38cc9309f76ebb9f10ba80205290f285f5c2a80aa0ed09f22179

  • SHA512

    eb8a10ebc06f14de9c6c688c3ed5f394662965805c9445182492226ab65e10ddf5100b89aa9d4350eeee9b7587f89c7bdf508fd4ab0b0e2364c769c1bb0a20e2

  • SSDEEP

    1536:6LxJJlguY/NbvWU2VkWlVvtlqDyKJR40AEEoU2l9e:cc/R+U23vtlPR0pTs

Malware Config

Targets

    • Target

      beca642671cd38cc9309f76ebb9f10ba80205290f285f5c2a80aa0ed09f22179.exe

    • Size

      86KB

    • MD5

      e37f06b0c7d88f4a8c186811a1079e4b

    • SHA1

      6a817e7234f3bdc125147d9771a847d827bb9f95

    • SHA256

      beca642671cd38cc9309f76ebb9f10ba80205290f285f5c2a80aa0ed09f22179

    • SHA512

      eb8a10ebc06f14de9c6c688c3ed5f394662965805c9445182492226ab65e10ddf5100b89aa9d4350eeee9b7587f89c7bdf508fd4ab0b0e2364c769c1bb0a20e2

    • SSDEEP

      1536:6LxJJlguY/NbvWU2VkWlVvtlqDyKJR40AEEoU2l9e:cc/R+U23vtlPR0pTs

    • Blocklisted process makes network request

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks