General

  • Target

    New_Order_PO-NG57283H9.exe

  • Size

    811KB

  • Sample

    241121-mh9fkawjfm

  • MD5

    2ce9ed0f21ef1669c62448d6513b9c72

  • SHA1

    31302d7550f3d118aaf62414157b7f1c5ff01459

  • SHA256

    4aa26829657bbdb5983129321451365832a69fde42f22687b9a7c598f2e04301

  • SHA512

    83aa83155d7222e2305a7eaf236a70ee2423df676d3b992abff20476b1d7c367e8fd32d88ca96d5dd20945c4b7cc87a0800830da8c7ab9056e7ab0d12e232d8d

  • SSDEEP

    12288:DcsCELA+12Hd5lpvS36pDfi/xN3xT6xbzlYVzxWW1oStiKqisv8yroNee50EEAH7:0zlEzxW22vvo0I

Malware Config

Targets

    • Target

      New_Order_PO-NG57283H9.exe

    • Size

      811KB

    • MD5

      2ce9ed0f21ef1669c62448d6513b9c72

    • SHA1

      31302d7550f3d118aaf62414157b7f1c5ff01459

    • SHA256

      4aa26829657bbdb5983129321451365832a69fde42f22687b9a7c598f2e04301

    • SHA512

      83aa83155d7222e2305a7eaf236a70ee2423df676d3b992abff20476b1d7c367e8fd32d88ca96d5dd20945c4b7cc87a0800830da8c7ab9056e7ab0d12e232d8d

    • SSDEEP

      12288:DcsCELA+12Hd5lpvS36pDfi/xN3xT6xbzlYVzxWW1oStiKqisv8yroNee50EEAH7:0zlEzxW22vvo0I

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks