General
- Target x2x2.exe
- Size 19.0MB
- Sample260815-vrddgszfrd
- SHA256 09a47c527ada5dd85276815533e3b47a1bd79b5b2411af15a430121dc3f42e85
Malware Config
Targets
-
- Target x2x2.exe
- Size 19.0MB
- SHA256 09a47c527ada5dd85276815533e3b47a1bd79b5b2411af15a430121dc3f42e85
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Executes a VBScript file via the Windows Script Host.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Authentication Process
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3