Overview

overview

10

Static

static

10

W9tWAcK95.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    analysis-copy-436e6e35.zip
  • Size 6.7MB
  • Sample261005-zgqy2sshkf
  • SHA256 436e6e3534705ce989e0e1b25142c2589248aed02d17a761ec1f93ba63501f8c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
acrstealerhijackloaderdefense_evasiondiscoveryloaderprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • hijackloader

Attributes
  • directory

    %APPDATA%\dispatcherhost

  • inject_dll

    %windir%\SysWOW64\pla.dll

xor.hex

Extracted

Family

  • acrstealer

xor.hex

Extracted

Family

  • acrstealer

Version

  • 4.4.3-alpha1

C2

  • metrics.unworldlylegacy.cc

Decoy

  • cdnjs.cloudflare.com

Attributes
  • ddrs

    telemetry.graywolf.cc

  • guids

    4d0bf37a-3180-4974-a873-a6ec4d4dc9f9

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Targets

    • Target
      W9tWAcK95.exe
    • Size 1.6MB
    • SHA256 1858d404ece8c1f5164520d1304d8c83fc39785d1823cb4513190715abaa922b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryacrstealerprivilege_escalationspywarestealer

    • Family: ACR stealer,GrMsk

      ACR stealer (aka GrMsk stealer) is an infostealer written in C++.

      stealeracrstealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

      defense_evasionprivilege_escalation

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks