General
- Target Marisa 2.4.1.exe
- Size 77.0MB
- Sample260809-q7bsdafr6v
- SHA256 0349a84d531abfd5cc5670cc55875e2a2f78eeb812d7b05eecd805b44cdac943
Malware Config
Targets
-
- Target Marisa 2.4.1.exe
- Size 77.0MB
- SHA256 0349a84d531abfd5cc5670cc55875e2a2f78eeb812d7b05eecd805b44cdac943
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 11.7MB
- SHA256 5d67aba37acc9e0e0a88546d940ed23f29ea3441aac7dd06dcc08a1b1c93b0a9
Score3/10 -
- Target Marisa.exe
- Size 192.0MB
- SHA256 b4cea023622862c508af3052b87f6dbe88843ad5b0052ed75a031402e2844fc1
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.9MB
- SHA256 99fbd8bd11696e24479d22e29b490c7e96c7d9875ab4392ff12307ddfb5a9503
Score1/10 -
- Target libEGL.dll
- Size 481KB
- SHA256 e55fb10fb929b28446583ebc5afa89fc647bafc2eebf3b12e6a0adf91a7bb202
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 2289eb00380b7f143d81df224d5bb412dec9b5eb6002b5213518e295ae8256b2
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/index.js
- Size 206B
- SHA256 632ab5a01dfc1b519b06275f490d6790100a2f8d71d8f56957091d0fcc5b3e0b
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/@koromix/koffi-win32-x64/win32_x64/koffi.node
- Size 1.5MB
- SHA256 2470bca8e26730762ca4b21ba15f233a45bf7f57bf2340826b9435843ea8cc14
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.8MB
- SHA256 901381b3f1fd78cf8858bcc14fb60a55242a9832da937e8effcafe6b889a3532
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 02ea23bdd23d7ac5de0675a2f32fc686e76d5c6a32bd3e3891f360e72e07f61f
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/inspect.js
- Size 174B
- SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
2Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1