General

  • Target

    KrnlsFiles.exe

  • Size

    7.7MB

  • Sample

    241215-zapgmsxpek

  • MD5

    6312471aa28c8c4f5fe03a45286fbae5

  • SHA1

    c044ff2115040904d2930c9f8bdef82ee04f0a8f

  • SHA256

    ccdd1ed00d7c84911a220628aa81ddc9d94853ccaa93ba096efad45828455c09

  • SHA512

    cf1f5ad33ae4f11c5ac1b85cb0f3104e8dee4df3450b1268e510a7e981e7475bd6281346635ba77e5cdd7ddf57c03fc2509aa86c4206fd0d77e7562aba841045

  • SSDEEP

    196608:e2DD+kdJWwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWv:jD5jdIHL7HmBYXrYSaUN9

Malware Config

Targets

    • Target

      KrnlsFiles.exe

    • Size

      7.7MB

    • MD5

      6312471aa28c8c4f5fe03a45286fbae5

    • SHA1

      c044ff2115040904d2930c9f8bdef82ee04f0a8f

    • SHA256

      ccdd1ed00d7c84911a220628aa81ddc9d94853ccaa93ba096efad45828455c09

    • SHA512

      cf1f5ad33ae4f11c5ac1b85cb0f3104e8dee4df3450b1268e510a7e981e7475bd6281346635ba77e5cdd7ddf57c03fc2509aa86c4206fd0d77e7562aba841045

    • SSDEEP

      196608:e2DD+kdJWwfI9jUCBB7m+mKOY7rXrZusoSDmhfvsbnTNeWv:jD5jdIHL7HmBYXrYSaUN9

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks