General

  • Target

    ItroublveTSC.exe

  • Size

    7.6MB

  • Sample

    241212-c8yfwasmcj

  • MD5

    d3ef02070bfa081974b1c1d3d479d1af

  • SHA1

    371913c4493df24aff9dd5511445d5a6d8c3e79c

  • SHA256

    ae5c57ff6ae53782f3767e0fcffcafb0368af0530c8197cd0fcaab1ffda98859

  • SHA512

    601c97e5fafd8a4ce57b8bc0301bec60d927c0b8ba1366e42a3bd6e0830f9c6448506df7586943b0c4f8763e67620ab6d5ec3967e61ba8bde43348aa004f5872

  • SSDEEP

    98304:MUvsBAgasrYqwRhI3l72Qj1qCVgWBg+uoQs+YX5dfXHzjNZnXscacRX1t9XMGh8j:MMgIqwfI9jUC2gYBYv3vbW+DcGiwwnL

Malware Config

Targets

    • Target

      ItroublveTSC.exe

    • Size

      7.6MB

    • MD5

      d3ef02070bfa081974b1c1d3d479d1af

    • SHA1

      371913c4493df24aff9dd5511445d5a6d8c3e79c

    • SHA256

      ae5c57ff6ae53782f3767e0fcffcafb0368af0530c8197cd0fcaab1ffda98859

    • SHA512

      601c97e5fafd8a4ce57b8bc0301bec60d927c0b8ba1366e42a3bd6e0830f9c6448506df7586943b0c4f8763e67620ab6d5ec3967e61ba8bde43348aa004f5872

    • SSDEEP

      98304:MUvsBAgasrYqwRhI3l72Qj1qCVgWBg+uoQs+YX5dfXHzjNZnXscacRX1t9XMGh8j:MMgIqwfI9jUC2gYBYv3vbW+DcGiwwnL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Target

      ���nT�.pyc

    • Size

      1KB

    • MD5

      a6fc969ec44017dd5da0a05f60b636d7

    • SHA1

      f066f3bf11d7401e7936bc995f0ffbbb95afb89f

    • SHA256

      df403f5a7cf7834810946e6905288a0013b2175b01fac3b3b42eaf14d4364222

    • SHA512

      b851345b57e667d4fb661a3968d4393e74a942d7d908cee658ac80b2585f6af46f5d512e46d541e3f4322278926a4d71e2bb9d016dc14c6e208f9e4c3739537c

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks