General
- Target setup.exe
- Size 79.2MB
- Sample260308-cf3vwsg16v
- SHA256 0ba60875de190dc353c4972053b326634cb23ec8fddc0b7de3d8d67fca11436b
Malware Config
Targets
-
- Target setup.exe
- Size 79.2MB
- SHA256 0ba60875de190dc353c4972053b326634cb23ec8fddc0b7de3d8d67fca11436b
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 5dad57ea08d8af1e78889e7b9191a0d4cb55e6124a447a8ab352064ca20a200d
Score1/10 -
- Target libEGL.dll
- Size 477KB
- SHA256 9d3bda43e5a5cecbed08429cd282bebf99934622a2790e714d95cd0228040c24
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 ab22f3d242aacd5ad30cb95f95e7091aa72416a68f51d5fa4cd78c3727b0be59
Score1/10 -
- Target microsoft-defender.exe
- Size 164.7MB
- SHA256 a8516a50aa2a5552ff6362555c0150805fcf395999a081756a8612faba21e845
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Adds Run key to start application
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Enumerates processes with tasklist
-
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 4.9MB
- SHA256 7488ef4036c46d4ef85c65efbc83617478a6401dbc00e94ec953fe46f0307857
Score1/10 -
- Target vulkan-1.dll
- Size 931KB
- SHA256 a30dee992d32d160d2eb55ed5c1320b5017b945c2aece5d0b26489d31b297599
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Indicator Removal
1File Deletion
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1