General
- Target mpclient.dll.exe
- Size 3.8MB
- Sample260621-hqtymacz3s
- SHA256 ff771fcecd52f9051afca243d97c785b4bec00bb87ef2392ed6a74c91c443fa7
Score
10/10
Malware Config
Targets
-
- Target mpclient.dll.exe
- Size 3.8MB
- SHA256 ff771fcecd52f9051afca243d97c785b4bec00bb87ef2392ed6a74c91c443fa7
Score10/10Suspicious use of NtCreateProcessExOtherParentProcess
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1