General

  • Target

    Game.exe

  • Size

    7.7MB

  • Sample

    241214-nd46qa1rcr

  • MD5

    07ad13f56a439c395ba890fb812af52d

  • SHA1

    6c87f8b2ae65a46af57dfc6df4bf5b0219939aec

  • SHA256

    ccffac4327d7c7fc56f9045ca29550f15d44b5c1da6b7dd282cd88350c91cf0e

  • SHA512

    635a8108c35748c71863beb583283ded0b1d52638ab87dc047cccdbfa499be255d41387cb4be691aaf33a00e338fe5c61b27e6c00f063d198fc0183c7078712f

  • SSDEEP

    196608:iZUHYIswfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jX:S6IHziK1piXLGVE4Ue0VJr

Malware Config

Targets

    • Target

      Game.exe

    • Size

      7.7MB

    • MD5

      07ad13f56a439c395ba890fb812af52d

    • SHA1

      6c87f8b2ae65a46af57dfc6df4bf5b0219939aec

    • SHA256

      ccffac4327d7c7fc56f9045ca29550f15d44b5c1da6b7dd282cd88350c91cf0e

    • SHA512

      635a8108c35748c71863beb583283ded0b1d52638ab87dc047cccdbfa499be255d41387cb4be691aaf33a00e338fe5c61b27e6c00f063d198fc0183c7078712f

    • SSDEEP

      196608:iZUHYIswfI9jUCzi4H1qSiXLGVi7DMgpZ3Q0VMwICEc/jX:S6IHziK1piXLGVE4Ue0VJr

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks