General
-
Target
Loud-Mic-Installer.exe
-
Size
6.9MB
-
Sample
241224-3jbhxszrgy
-
MD5
db82ee913ff7c17e488a2ae7ae82503c
-
SHA1
5f56c998d5f693fb4dbf25e8dac6eda9d9991670
-
SHA256
d816bc729f5d6b20d29a851718a144494e6b6ee3be71875abc35710dab1f3305
-
SHA512
1e18c5745b97ddb01957c85f1889dc61f347b8157e15499a74208820ac14912adb72ea6cae9b9cbea1d3bca0c33463e8b65fa549a5a9420bdb687a5f7f857f82
-
SSDEEP
98304:WShDjWM8JEE1rU9amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRGYKJJcGhEIK:W00JeNTfm/pf+xk4dWRGtrbWOjgWyZ
Behavioral task
behavioral1
Sample
Loud-Mic-Installer.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Targets
-
-
Target
Loud-Mic-Installer.exe
-
Size
6.9MB
-
MD5
db82ee913ff7c17e488a2ae7ae82503c
-
SHA1
5f56c998d5f693fb4dbf25e8dac6eda9d9991670
-
SHA256
d816bc729f5d6b20d29a851718a144494e6b6ee3be71875abc35710dab1f3305
-
SHA512
1e18c5745b97ddb01957c85f1889dc61f347b8157e15499a74208820ac14912adb72ea6cae9b9cbea1d3bca0c33463e8b65fa549a5a9420bdb687a5f7f857f82
-
SSDEEP
98304:WShDjWM8JEE1rU9amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRGYKJJcGhEIK:W00JeNTfm/pf+xk4dWRGtrbWOjgWyZ
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3