General
-
Target
d2wDTIm.exe
-
Size
7.5MB
-
Sample
250119-yc45fasncs
-
MD5
abd4f1e520621cf1deceb5a651481486
-
SHA1
2f846c3de7050c367bade25e0ba20d6ebe1369f9
-
SHA256
fd7baa7e1e9628cec52b0137fc21cfc2f80d5a61787020c434fb7e6a89ddefca
-
SHA512
8f414601bf9a18ce106f147bb5676a5fe2c2a1c110ccd0a76c4953e9de78c05738652fe6e1a717f0550e01aa9b8886296c38df86360fff8666688a17eee7f9d9
-
SSDEEP
196608:ndSdzr2MwlirTB4p5jA60eyWpzaYJ2ge6fwbthSjnE5su:nOn2xiafjV07WgYW64F5
Static task
static1
Behavioral task
behavioral1
Sample
d2wDTIm.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d2wDTIm.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
d2wDTIm.exe
-
Size
7.5MB
-
MD5
abd4f1e520621cf1deceb5a651481486
-
SHA1
2f846c3de7050c367bade25e0ba20d6ebe1369f9
-
SHA256
fd7baa7e1e9628cec52b0137fc21cfc2f80d5a61787020c434fb7e6a89ddefca
-
SHA512
8f414601bf9a18ce106f147bb5676a5fe2c2a1c110ccd0a76c4953e9de78c05738652fe6e1a717f0550e01aa9b8886296c38df86360fff8666688a17eee7f9d9
-
SSDEEP
196608:ndSdzr2MwlirTB4p5jA60eyWpzaYJ2ge6fwbthSjnE5su:nOn2xiafjV07WgYW64F5
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1