33d66ffd2c60f60632bb104b22fb631bfc72c88f095f0d24f476aa5e1faa1729

Sharing

Copy URL Twitter E-mail

General

Target
14112024_1608_14112024_Rechnungen.zip
Size 5KB
Sample241114-tlj4ea1ekf
SHA256 33d66ffd2c60f60632bb104b22fb631bfc72c88f095f0d24f476aa5e1faa1729
MD5 7ef2a348ce161839da2db0f2b74d9212
SHA1 dfaff6baaed526bfd893f3c3b4964aca9ac06f01
SHA512 6a1ac309a6f9d8667f9dd61ec21eae6f9dcd26a1edbc3abec6d2a73029fd08c971f9e7337ba4e3e7730084e5ea887d79d93694725c43948d5c9064ced52910ee
SSDEEP 96:601D6/h/0MRUsXoOBbXZL8wnom4NZojAHOqyOlCdG3QlqgeVF9kl:Z1Ad0MTXz18O94Nk2u+Ce8/N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta

Extracted

Language

Source

URLs

hta.dropper
https://pub-5b9223b1b9e74a70be22a0816a8b7ead.r2.dev/123.hta

Targets

- Target
  Rechnung_2024_0091.pdf.lnk
- Size 3KB
- SHA256 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
- MD5 001c1231f099ae2188df58798c2c32cf
- SHA1 6e8394a04aa35551437d91910c787bf2165c175b
- SHA512 b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
- MD5 SHA1 SHA512
Score

10^/10

execution collection discovery spyware stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Rechnung_2024_0092.pdf.lnk
- Size 3KB
- SHA256 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
- MD5 001c1231f099ae2188df58798c2c32cf
- SHA1 6e8394a04aa35551437d91910c787bf2165c175b
- SHA512 b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
- MD5 SHA1 SHA512
Score

10^/10

execution collection discovery spyware stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  Rechnung_2024_0093.pdf.lnk
- Size 3KB
- SHA256 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
- MD5 001c1231f099ae2188df58798c2c32cf
- SHA1 6e8394a04aa35551437d91910c787bf2165c175b
- SHA512 b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
- MD5 SHA1 SHA512
Score

10^/10

execution collection discovery spyware stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  Rechnung_2024_0094.pdf.lnk
- Size 3KB
- SHA256 0d6049a23bc24a385997c0514ffc22a9c0c9ba681d1cac2f6cb5013bafeefe4f
- MD5 001c1231f099ae2188df58798c2c32cf
- SHA1 6e8394a04aa35551437d91910c787bf2165c175b
- SHA512 b46b0ed51706e68a7b2e1d3609caaa2bc45676cb876c9ca72c51d9e34d2e5821dba256378950b3dc678d44c0cbfe14a6f599c66fb6843a34c76f7e258959e2c9
- MD5 SHA1 SHA512
Score

10^/10

execution collection discovery spyware stealer
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8