General
- Target Setup.exe
- Size 11.1MB
- Sample260817-zee4rsdf64
- SHA256 891292d66392d8da0e92cf38abcb108a69e33fb1714f7920448301b1aa5094d5
Score
8/10
Malware Config
Targets
-
- Target Setup.exe
- Size 11.1MB
- SHA256 891292d66392d8da0e92cf38abcb108a69e33fb1714f7920448301b1aa5094d5
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2