hxxp://185[.]199[.]199[.]136[:]3000/

General

Target
http://185.199.199.136:3000/
Sample260816-e5f4jazzf1

Score

10^/10

Malware Config

Targets

- Target
  http://185.199.199.136:3000/
Score

10^/10

defense_evasion discovery evasion execution persistence ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Executes dropped EXE
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1