General
- Target setup.exe
- Size 74.0MB
- Sample260628-le5grsgt2s
- SHA256 b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2
Malware Config
Targets
-
- Target setup.exe
- Size 74.0MB
- SHA256 b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 73.5MB
- SHA256 9c036169ba541c13fb657559e81506f5375c8a29d9325a763c3062477072ee0c
Score1/10 -
- Target locales/zh-CN.pak
- Size 319KB
- SHA256 4ff334da089d2ffb9c6173de7c918b74c9326ed7bd76317b2696d57861871488
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/zh-TW.pak
- Size 316KB
- SHA256 a0a715a3ef1ead036f0f03d02a8252fbdbd52ce6f8cc5b9298fc1c4494d4e508
Score3/10 -
- Target owutility.dll
- Size 1.4MB
- SHA256 c127bd152b674d35a7c5a65cc933c385d64622ae2ea09b7194c1de7bdda1c690
Score1/10 -
- Target resources.pak
- Size 5.1MB
- SHA256 3dfde11380615c1204b026f94e39ac503f1785d4b967e40d5384bd092c4f0c74
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app-update.yml
- Size 99B
- SHA256 38c8aad86e8a999394fbc565c58a53204971766c6e85550e2268063f9c662bdf
Score3/10 -
- Target resources/app.asar
- Size 19.8MB
- SHA256 e86e6fc78ecb001a6bbd0e86c203f254f89743f8397a2c37796a9a7b1bb44f6f
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target resources/libraries/java/PackXZExtract.jar
- Size 120KB
- SHA256 a847432bdf7da12571bbd5bda3b11ca3664675d1ff9baad5abd59b2d0689fa93
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/libraries/java/launcher.jar
- Size 3.9MB
- SHA256 61ab765fa1f743d34d84e0415144cbff5604ecb7a91370f1ee658f964602afc9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target snapshot_blob.bin
- Size 168KB
- SHA256 943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1