General

  • Target

    a7ea9d5427e6f661fd045a2c132eac0033e3e92902e5033402bf6a3a65759322

  • Size

    5.3MB

  • Sample

    241121-y6b1rawrhx

  • MD5

    0cbbe510f4f5981fa94accf04fedf68c

  • SHA1

    320b35249b29882a11496406943cbd845ce181a7

  • SHA256

    a7ea9d5427e6f661fd045a2c132eac0033e3e92902e5033402bf6a3a65759322

  • SHA512

    cee9a3208d35146163ef0170bb9511c78f211ac38402bf119abe5b23c430615123effa856e02e6ce1fbefb179ee5d0ba9c8f9cf0e9565c6571ca03f92740ad94

  • SSDEEP

    98304:yA3utc4HTUfGJeO3ADxzbWtbsTZlVkAh0YdtLltwvz/:Nuc4QjVHWClVkAXLlGb

Malware Config

Targets

    • Target

      a7ea9d5427e6f661fd045a2c132eac0033e3e92902e5033402bf6a3a65759322

    • Size

      5.3MB

    • MD5

      0cbbe510f4f5981fa94accf04fedf68c

    • SHA1

      320b35249b29882a11496406943cbd845ce181a7

    • SHA256

      a7ea9d5427e6f661fd045a2c132eac0033e3e92902e5033402bf6a3a65759322

    • SHA512

      cee9a3208d35146163ef0170bb9511c78f211ac38402bf119abe5b23c430615123effa856e02e6ce1fbefb179ee5d0ba9c8f9cf0e9565c6571ca03f92740ad94

    • SSDEEP

      98304:yA3utc4HTUfGJeO3ADxzbWtbsTZlVkAh0YdtLltwvz/:Nuc4QjVHWClVkAXLlGb

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks