General
- Target WatchVexSetup.7z
- Size 92.0MB
- Sample260811-qsa8aser8y
- SHA256 ffa9bd25135644e06a66b53447d937dbaf981ab1d5e2cd15e8da2e1bfbb21cff
Malware Config
Targets
-
- Target WatchVexSetup.exe
- Size 92.1MB
- SHA256 788c34e54ad582eed5b3a3e3b5f307d1b30c2e8942ef5993f749204515a05679
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target iva-host.exe
- Size 164.7MB
- SHA256 3f50bff8604b1d3298f4a38e9fd5d54c974c17e00259d30c83781feb82e1e4e2
Score7/10-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1