e1dd3f7690e93fe69c6a0507c36b9b80a31b47b5f789d333128349e9d19b844d

General

Target
g3qs9jkdmlovrdxp.bat
Size 1.8MB
Sample260822-m4felstcng
SHA256 e1dd3f7690e93fe69c6a0507c36b9b80a31b47b5f789d333128349e9d19b844d
MD5 ded6fbc385e507feca91c1b1a97d769f
SHA1 b444479429cb50aa6094d3b96bd62369dbc3b9c0
SHA512 32f5fbfbea14f4a7ae73152818c856ea6dcc7098dc7b39e3c7cd4aab77c723baca3dc9e7af41b844c46bddb2143f32fc7c771047df746247b36db5b34f64f0c3
SSDEEP 24576:X4TgsK7JHmzg7GKl5P/aD3jf5NKijih4lq+iEbHezEkK6CbcUsvXFT7hi2:XjGs7PG/x1ih4lq+iEzmrKiB
TLSH
T1B195140D7E4C1656CF1569FF702E8F08767204CB4A61A8607D67782AADEE7C4B10CAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  g3qs9jkdmlovrdxp.bat
- Size 1.8MB
- SHA256 e1dd3f7690e93fe69c6a0507c36b9b80a31b47b5f789d333128349e9d19b844d
- MD5 ded6fbc385e507feca91c1b1a97d769f
- SHA1 b444479429cb50aa6094d3b96bd62369dbc3b9c0
- SHA512 32f5fbfbea14f4a7ae73152818c856ea6dcc7098dc7b39e3c7cd4aab77c723baca3dc9e7af41b844c46bddb2143f32fc7c771047df746247b36db5b34f64f0c3
- SSDEEP 24576:X4TgsK7JHmzg7GKl5P/aD3jf5NKijih4lq+iEbHezEkK6CbcUsvXFT7hi2:XjGs7PG/x1ih4lq+iEzmrKiB
- TLSH
  T1B195140D7E4C1656CF1569FF702E8F08767204CB4A61A8607D67782AADEE7C4B10CAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1