Overview

overview

10

Static

static

10

MidnightLauncher.exe

windows10-2004-x64

7

MidnightLauncher.exe

windows10-ltsc 2021-x64

7

main.pyc

windows10-2004-x64

3

main.pyc

windows10-ltsc 2021-x64

3

Resubmissions

27-11-2024 18:29

241127-w49g5avlhy 10

27-11-2024 17:30

241127-v3dhmasrcz 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MidnightLauncher.exe

  • Size

    17.9MB

  • Sample

    241127-w49g5avlhy

  • MD5

    99e7fb22d61afd0d3eae3fd0de136a19

  • SHA1

    a613a69be5eb2444838aee2affbca5c3dc378a4d

  • SHA256

    7d212f9db88825f5c5adebafe15eb8b4c10332dba4739e352dd4bea31eb1774b

  • SHA512

    12cd68fff8c8040ae3d8e165d0b686d8f46861dbd1274471dd93421ccd6404acfb730b4542e02dc2c4d4360c8f06b99341c84995ca6e68504cc7edf87ed4d904

  • SSDEEP

    393216:BqPnLFXlrRQMDOETgsvfGyg1wJ6ZjYUGppL++Lle:oPLFXNRQRENkNNYbpLJe

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      MidnightLauncher.exe

    • Size

      17.9MB

    • MD5

      99e7fb22d61afd0d3eae3fd0de136a19

    • SHA1

      a613a69be5eb2444838aee2affbca5c3dc378a4d

    • SHA256

      7d212f9db88825f5c5adebafe15eb8b4c10332dba4739e352dd4bea31eb1774b

    • SHA512

      12cd68fff8c8040ae3d8e165d0b686d8f46861dbd1274471dd93421ccd6404acfb730b4542e02dc2c4d4360c8f06b99341c84995ca6e68504cc7edf87ed4d904

    • SSDEEP

      393216:BqPnLFXlrRQMDOETgsvfGyg1wJ6ZjYUGppL++Lle:oPLFXNRQRENkNNYbpLJe

    Score
    7/10
    upxdiscoverypersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      main.pyc

    • Size

      7KB

    • MD5

      793684cf2df4fe2a45014975fbadb918

    • SHA1

      e96efa7ba483a6b6dc19275c6d18f246ac7ea174

    • SHA256

      1558e5e163919f9e6694ae160efa02f11fa781e6be90e2e8d8ca264b4519df81

    • SHA512

      824399d75293ad72190d7f95ca9ac9519b640c205c0edc60350e1842c1f1970c7af8020c07285e3cdd0e3440bee66d85a5a2b819f98c8d8f9fb9f17d4f8bfa08

    • SSDEEP

      192:w7cLAVWfVr2QD8VSWdXwD+sgoEkyJhwPf2nMdwm4nw:CV4VSSWuKE22aPm4w

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Information Discovery

1
T1082

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks