General
- Target RE-690215-374880%20Rechnung%20DE4917602.vbs
- Size 14.9MB
- Sample260625-w1hj8set9t
- SHA256 79507c5ec1f7c1fa1b94cf8b5ce534fe1634b8c44f3ebee7e86e1da09ebf84f0
Score
10/10
Malware Config
Targets
-
- Target RE-690215-374880%20Rechnung%20DE4917602.vbs
- Size 14.9MB
- SHA256 79507c5ec1f7c1fa1b94cf8b5ce534fe1634b8c44f3ebee7e86e1da09ebf84f0
Score10/10Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1