Overview

overview

7

Static

static

3

Bootstrapper.exe

windows7-x64

7

Bootstrapper.exe

windows10-2004-x64

7

$TEMP/Climate.htm

windows7-x64

3

$TEMP/Climate.htm

windows10-2004-x64

3

$TEMP/Duo.htm

windows7-x64

3

$TEMP/Duo.htm

windows10-2004-x64

3

$TEMP/London.htm

windows7-x64

3

$TEMP/London.htm

windows10-2004-x64

3

$TEMP/Lyrics.htm

windows7-x64

3

$TEMP/Lyrics.htm

windows10-2004-x64

3

$TEMP/Matrix.htm

windows7-x64

3

$TEMP/Matrix.htm

windows10-2004-x64

3

$TEMP/Re.htm

windows7-x64

3

$TEMP/Re.htm

windows10-2004-x64

3

$TEMP/Sunshine.htm

windows7-x64

3

$TEMP/Sunshine.htm

windows10-2004-x64

3

$TEMP/Treatments.htm

windows7-x64

3

$TEMP/Treatments.htm

windows10-2004-x64

3

$TEMP/Voyeurweb.htm

windows7-x64

3

$TEMP/Voyeurweb.htm

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Bootstrapper.exe
  • Size 1.1MB
  • Sample250221-14k7raskfj
  • SHA256 f19994d012146df1a2929fde0b0564b1e9ddaf7ececa406e53bf688df8ae3f12
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Targets

    • Target
      Bootstrapper.exe
    • Size 1.1MB
    • SHA256 f19994d012146df1a2929fde0b0564b1e9ddaf7ececa406e53bf688df8ae3f12
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryspywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2
    • Target
      $TEMP/Climate.htm
    • Size 75KB
    • SHA256 e5ce8c004e751437c0dc387546685f684b6c7bb133d1ce8bef06ea3889b6df00
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $TEMP/Duo.htm
    • Size 94KB
    • SHA256 031785e072e5564841e9ce384ba67b4663d3398bf988e7afcf10167c218d838e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $TEMP/London.htm
    • Size 57KB
    • SHA256 3ab580e15a4522608bf76a690cace724fa072e3a2aad18925b8b71d1d6b5b662
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $TEMP/Lyrics.htm
    • Size 73KB
    • SHA256 33f3aced4c37c2f13c8a7037b90dc0ee20e958d64a99732f8f1802aa999361ed
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $TEMP/Matrix.htm
    • Size 51KB
    • SHA256 cf2bcdfd50e651d92b474dddc78f43d3d3f86d42c398306fdd9f01dd12bad35c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $TEMP/Re.htm
    • Size 33KB
    • SHA256 75618f59fa6480cbeba511de38dbc17b437c3f729c9e7a2c3d6ef3ecd6e869ee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $TEMP/Sunshine.htm
    • Size 69KB
    • SHA256 725f806ce1a2c000f5f141af0914ab17fa9ccd3ada53a2d161a78660e4f5bec3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $TEMP/Treatments.htm
    • Size 19KB
    • SHA256 dc14c34c7935e41c2533405d17c33363dd35b33b2aa4b8e938d1c6b2eccddbfe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      $TEMP/Voyeurweb.htm
    • Size 73KB
    • SHA256 322ab27d0509fc828aed7879c2cdc4c046c28c70e2511fc24a715c6cd98d5d01
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks