General
- Target build_1540 (1).bat
- Size 3.9MB
- Sample260519-j46d9ahs2w
- SHA256 37f437f31c574d11af4a94087dce32e47a81642d2c14cf6ab08387f233d37784
Score
8/10
Malware Config
Targets
-
- Target build_1540 (1).bat
- Size 3.9MB
- SHA256 37f437f31c574d11af4a94087dce32e47a81642d2c14cf6ab08387f233d37784
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3