General

  • Target

    de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7.exe

  • Size

    708KB

  • Sample

    241119-xj4a2szmds

  • MD5

    e71cfdc85798bbb2a48f40aab4c2ba37

  • SHA1

    3142df2e596805f913d03b215393c35286166162

  • SHA256

    de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7

  • SHA512

    d82cb9b42d7228a51c772f716e06c899b05200b99f49d82db8b7dec625cd898815a917076145517aee4550cda690c94807d17b92e614e2724296102feb251a0c

  • SSDEEP

    12288:1S6E/s0yhD7tzPdEn7Nb+U2fljiBuRUVOScmGAltbkb:6U/R16lEiPOScJAi

Malware Config

Targets

    • Target

      de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7.exe

    • Size

      708KB

    • MD5

      e71cfdc85798bbb2a48f40aab4c2ba37

    • SHA1

      3142df2e596805f913d03b215393c35286166162

    • SHA256

      de9bedd12d8ac2d988657deb81c62e9db71678809edfbbffd429a3a766cf66a7

    • SHA512

      d82cb9b42d7228a51c772f716e06c899b05200b99f49d82db8b7dec625cd898815a917076145517aee4550cda690c94807d17b92e614e2724296102feb251a0c

    • SSDEEP

      12288:1S6E/s0yhD7tzPdEn7Nb+U2fljiBuRUVOScmGAltbkb:6U/R16lEiPOScJAi

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks