General

  • Target

    RuntimeBrokerVers.exe

  • Size

    13.1MB

  • Sample

    241114-1yjfzatfph

  • MD5

    4fd34971f2551e33806360ba5ee86e5e

  • SHA1

    a3f2fe7d770d45c0b98bdbdf3322614582e41d59

  • SHA256

    e82fe9ce4fec710c6f02dc3ed738e5a88955d4d938957ec2b49119d5018ecb81

  • SHA512

    1c01226cb0a061675a8af6db24dea570881bbd7a2d6c8e21aaf51884bf4b64a2011dcc881507fb0b0a0191f8dc180831833eb175f07d6fdee72ed11748183281

  • SSDEEP

    393216:85CCDJlS/FyOUUGafnbRngsndGKLYHSJj:8oCytjGafSsdx4k

Malware Config

Targets

    • Target

      RuntimeBrokerVers.exe

    • Size

      13.1MB

    • MD5

      4fd34971f2551e33806360ba5ee86e5e

    • SHA1

      a3f2fe7d770d45c0b98bdbdf3322614582e41d59

    • SHA256

      e82fe9ce4fec710c6f02dc3ed738e5a88955d4d938957ec2b49119d5018ecb81

    • SHA512

      1c01226cb0a061675a8af6db24dea570881bbd7a2d6c8e21aaf51884bf4b64a2011dcc881507fb0b0a0191f8dc180831833eb175f07d6fdee72ed11748183281

    • SSDEEP

      393216:85CCDJlS/FyOUUGafnbRngsndGKLYHSJj:8oCytjGafSsdx4k

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

    • Exelastealer family

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks