Overview

overview

10

Static

static

3

WarpProtec....1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WarpProtect Setup 1.1.1.exe

  • Size

    82.8MB

  • Sample

    241114-s6d78azqcz

  • MD5

    73ca9acca0d78f4739300359ebb205c4

  • SHA1

    a1d3396b16e33a099cb83fb154a63555e84cc7e2

  • SHA256

    30edb83667b18d3e5b7c8d33484024abce40541afdf306762a84fba2645349b0

  • SHA512

    9ce8c4f94098e79eac5c4b1f975ebbdd628a8fa026773ed32411ba4a289e947dbaee40e2c5481471e75cb295b31828894f9d2e2f5ecbe996a3489436f7622f8a

  • SSDEEP

    1572864:O+J39Kk9Mnn+MvnyTJ7sDjYB8ceyIS7nqYdd6hIEuZRoq2h/h52W:O1k9MnPnytQDjY/vP7nMuYh/hoW

Score
10/10
hexoncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      WarpProtect Setup 1.1.1.exe

    • Size

      82.8MB

    • MD5

      73ca9acca0d78f4739300359ebb205c4

    • SHA1

      a1d3396b16e33a099cb83fb154a63555e84cc7e2

    • SHA256

      30edb83667b18d3e5b7c8d33484024abce40541afdf306762a84fba2645349b0

    • SHA512

      9ce8c4f94098e79eac5c4b1f975ebbdd628a8fa026773ed32411ba4a289e947dbaee40e2c5481471e75cb295b31828894f9d2e2f5ecbe996a3489436f7622f8a

    • SSDEEP

      1572864:O+J39Kk9Mnn+MvnyTJ7sDjYB8ceyIS7nqYdd6hIEuZRoq2h/h52W:O1k9MnPnytQDjY/vP7nMuYh/hoW

    Score
    10/10
    hexoncredential_accessdiscoveryspywarestealer

    • Hexon family

      hexon

    • Hexon stealer

      Hexon is a stealer written in Electron NodeJS.

      stealerhexon

    • Blocklisted process makes network request

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks