General

  • Target

    f7235bcd107968a60cc9bf8a8739f1a62bc0b01a4bc24a108d28b2dbf39ee7ef.exe

  • Size

    91KB

  • Sample

    250119-wen5wsynax

  • MD5

    506ecbd83657ca0210451c42f2293496

  • SHA1

    ba4afc67a2c5b3f45ac82b0e6020df9dc96ad27d

  • SHA256

    f7235bcd107968a60cc9bf8a8739f1a62bc0b01a4bc24a108d28b2dbf39ee7ef

  • SHA512

    28471d32428bc1893f03d948445a6adb217d7dc5968326d9578bb5581cf51cab3212a061961d598c93ba4df0d501e322ac2a7114cfd25de98be3d49c4c965b55

  • SSDEEP

    1536:6LxJJlguY/NbvWU2VkWlVvtlqDyKJR40AEEoUG:cc/R+U23vtlPR0pP

Malware Config

Targets

    • Target

      f7235bcd107968a60cc9bf8a8739f1a62bc0b01a4bc24a108d28b2dbf39ee7ef.exe

    • Size

      91KB

    • MD5

      506ecbd83657ca0210451c42f2293496

    • SHA1

      ba4afc67a2c5b3f45ac82b0e6020df9dc96ad27d

    • SHA256

      f7235bcd107968a60cc9bf8a8739f1a62bc0b01a4bc24a108d28b2dbf39ee7ef

    • SHA512

      28471d32428bc1893f03d948445a6adb217d7dc5968326d9578bb5581cf51cab3212a061961d598c93ba4df0d501e322ac2a7114cfd25de98be3d49c4c965b55

    • SSDEEP

      1536:6LxJJlguY/NbvWU2VkWlVvtlqDyKJR40AEEoUG:cc/R+U23vtlPR0pP

    • Blocklisted process makes network request

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks