General
- Target WatchForParty Setup 1.2.0.exe
- Size 79.6MB
- Sample260809-1nhrpazsat
- SHA256 629cfb8d9fcb99aa0083415da49692ce4c94ecf01ed173e628a8ea8a9d4a5cf9
Malware Config
Targets
-
- Target WatchForParty Setup 1.2.0.exe
- Size 79.6MB
- SHA256 629cfb8d9fcb99aa0083415da49692ce4c94ecf01ed173e628a8ea8a9d4a5cf9
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 9.8MB
- SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
Score3/10 -
- Target WatchForParty.exe
- Size 168.9MB
- SHA256 69d1a1ad45fa8613568c9d59bd716af9fc3f3488bfb582f3b8a9a97978b4a995
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
Score1/10 -
- Target libEGL.dll
- Size 469KB
- SHA256 76efadca4ef6d2abe6ab3701b4071e04470eebfeed8d8d22c7252683bcbb37b1
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 150a02e43426a0886f023e88cd88454fb0e78696ea3881347a6256920c7a02ba
Score1/10 -
- Target resources/elevate.exe
- Size 119KB
- SHA256 e46cd986f4824316f0bb854a5536ba99e50d34e67e153889e395cad0f682993a
Score3/10 -
- Target vk_swiftshader.dll
- Size 5.1MB
- SHA256 6ff65b7a5faf726cf747eca6d6504e885a70664e37dc5e38e0e0cc68bed3bf6d
Score1/10 -
- Target vulkan-1.dll
- Size 935KB
- SHA256 715dca5af441dc220a61fb0f8e66600dc4f9f63ecc106fa43bc683098e00fff8
Score1/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score3/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10 -
- Target $R0/Uninstall WatchForParty.exe
- Size 260KB
- SHA256 4b72d22e17424e4631cbd3defe03808217f7bd91866e190a85c6f15068442d9e
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5PowerShell
3Visual Basic
1Windows Command Shell
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1