General
- Target winhost.exe
- Size 80.9MB
- Sample261007-pcr1fayx2m
- SHA256 bed116abf922b28f79323cce3901e206e82cb4a37020c623217ff1541baa00f1
Malware Config
Targets
-
- Target winhost.exe
- Size 80.9MB
- SHA256 bed116abf922b28f79323cce3901e206e82cb4a37020c623217ff1541baa00f1
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Epsilon Stealer
Information stealer.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.7MB
- SHA256 c6080d60736384a4a8fdd23404d59ae2d939e5124d80df89f8fd4e450bb9bd6f
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc
Score1/10 -
- Target libEGL.dll
- Size 481KB
- SHA256 d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220
Score1/10 -
- Target libGLESv2.dll
- Size 8.0MB
- SHA256 4b4dcbc7bb19449ec89d2bf06e7b05af9352a4e6f97f4444183dc3080e6c0f1d
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node
- Size 1.6MB
- SHA256 b66a0400ccfda4cc16479381d21f7426b82b9b88e0256061935a76cdaa766c03
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/copy.js
- Size 897B
- SHA256 05a2bd41dbd96e33e2fc6cf4bcbc722b4bc8c529813b882f92113d7dbbbece67
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/deps/download.sh
- Size 3KB
- SHA256 5de8af6e9f41fc1b5f6d280cdc55d62c2a210faf722c7e529b6b3427be7c80a8
Score7/10-
Executes dropped EXE
-
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/database.js
- Size 4KB
- SHA256 50fe0b490f29174d961c4d1ae54f22973447ff1255fd710e785d201c0ebfb4d0
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/index.js
- Size 110B
- SHA256 82db11c4ee43a41d859988c5db42c3771dff565371f94bacbd1e4d8d6ceb47cd
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/aggregate.js
- Size 1KB
- SHA256 e9f74eb919ec93fe089c95ddf25a98f1f631c80418fa34fb2346ca1bc29f1b82
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/backup.js
- Size 2KB
- SHA256 ea29d34992bb02e006d0fdeda9675ac5d2bb227aaf57468decd997e9fc9c7dbf
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/function.js
- Size 1KB
- SHA256 f431d49303b8bbdc044b1f1b455bdad21fc9b74b007de0acb22f08f25b4febd3
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/better-sqlite3/lib/methods/inspect.js
- Size 174B
- SHA256 4975a78daee850adee62ba98719d0f223819a0ec135a07c0e302994bd8dbff61
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
2Unix Shell
1Windows Command Shell
1Windows Management Instrumentation
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
2Virtualization/Sandbox Evasion
1System Checks
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
4System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
4Internet Connection Discovery
2System Time Discovery
1Virtualization/Sandbox Evasion
1System Checks
1