Extracted

• • Target
    https://meet-brave.com/5861c985-6ec4-4f35-8595-8acb8398b117/

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionpersistencespywarestealertrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious clipboard content.

    A suspicious script was copied to clipboard.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1