General
-
Target
7a3707c624ea4354e592119c5b6e8fea02f2578e8dd8134baf0360587b5f0b7bN.exe
-
Size
7.3MB
-
Sample
241216-dp6hta1nbz
-
MD5
a64289d915d16709a5327a88045ac4f0
-
SHA1
2d81be46f413c564e2a961dfdf7773272a66f4e0
-
SHA256
7a3707c624ea4354e592119c5b6e8fea02f2578e8dd8134baf0360587b5f0b7b
-
SHA512
9353fd8e1648f498f7e86111db36deac317fa71b9e038a95a5e0323f0821445f36b35875bf804ec12ad83779a03e80b7e026cb9d6cd20d1c07dfd86368e5fe42
-
SSDEEP
196608:kmYS6/OshoKMuIkhVastRL5Di3u41D7dJj:9YSAOshouIkPftRL54VRDj
Behavioral task
behavioral1
Sample
7a3707c624ea4354e592119c5b6e8fea02f2578e8dd8134baf0360587b5f0b7bN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7a3707c624ea4354e592119c5b6e8fea02f2578e8dd8134baf0360587b5f0b7bN.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
7a3707c624ea4354e592119c5b6e8fea02f2578e8dd8134baf0360587b5f0b7bN.exe
-
Size
7.3MB
-
MD5
a64289d915d16709a5327a88045ac4f0
-
SHA1
2d81be46f413c564e2a961dfdf7773272a66f4e0
-
SHA256
7a3707c624ea4354e592119c5b6e8fea02f2578e8dd8134baf0360587b5f0b7b
-
SHA512
9353fd8e1648f498f7e86111db36deac317fa71b9e038a95a5e0323f0821445f36b35875bf804ec12ad83779a03e80b7e026cb9d6cd20d1c07dfd86368e5fe42
-
SSDEEP
196608:kmYS6/OshoKMuIkhVastRL5Di3u41D7dJj:9YSAOshouIkPftRL54VRDj
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3