General
- Target DemoInkborn.zip
- Size 129.3MB
- Sample261016-2gft7aev5t
- SHA256 84a1fca2b7b06f8ba17b6df233924f497668d702556ddc7ea21e90bcb88efdc2
Malware Config
Targets
-
- Target DemoInkbornSetup.exe
- Size 129.3MB
- SHA256 cb5a075056bd66fd9d7f6d4b8c88f3779bd3db74c4864161093c422cf6956d31
Score8/10-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target DemoInkbornSetup.exe
- Size 213.4MB
- SHA256 6ec0fd76657d48d7f2f029860f5b0ce4357efd7bad41e2b0103cc55f52f21867
Score8/10-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
-
- Target LICENSES.chromium.html
- Size 18.6MB
- SHA256 0883a9eb407906c12b334d89bc5fbc63bd1df9e0803c252cc8d23cb76b6d58f3
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
Score1/10 -
- Target dxcompiler.dll
- Size 24.5MB
- SHA256 19b5788f5fc04c963b191efab9795bf4a294b0dc7dc8a33e3c4c75e7d13bbda9
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
Score1/10 -
- Target ffmpeg.dll
- Size 3.0MB
- SHA256 f6f46577037db135c29490155bde31014af67a7770f43dfb4e3d7607873170cb
Score1/10 -
- Target libEGL.dll
- Size 510KB
- SHA256 1d39cd65afeacdd3270fd5c47301d0727ca3467f8e50e17b13bfa861f28fcc25
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 9869159dc3f62f52033c38ad22fa7a586555d103b56e30091234690525f19cba
Score1/10 -
- Target resources/7za-ia32.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
Score3/10 -
- Target resources/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
Score1/10 -
- Target resources/app.asar
- Size 39KB
- SHA256 d3732f4db7d576bd418c9faf3f3caa6924b914ad6a87f1580757ffcc3ca7b9d8
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
Score4/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
2Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
2Hidden Window
1Ignore Process Interrupts
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
1System Time Discovery
1