General
- Target lvrium_loader.exe
- Size 322KB
- Sample260626-tp164adt7n
- SHA256 91ec1d12305c64980ad1d79d8ddf018f9055f4188cacd0bee8881a2e41b5b923
Malware Config
Targets
-
- Target lvrium_loader.exe
- Size 322KB
- SHA256 91ec1d12305c64980ad1d79d8ddf018f9055f4188cacd0bee8881a2e41b5b923
Score8/10-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Boot or Logon Autostart Execution: Print Processors
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Indicator Removal: Clear Windows Event Logs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Modifies termsrv.dll
Commonly used to allow simultaneous RDP sessions.
MITRE ATT&CK Enterprise v16
Defense Evasion
Indicator Removal
2Clear Windows Event Logs
1File Deletion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1