Overview

overview

7

Static

static

3

Chrome.exe

windows10-2004-x64

7

Chrome.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    Chrome.exe
  • Size 27.2MB
  • Sample261023-wrdvpadd28
  • SHA256 0cd3361f85a665218e9d5ee58820fad95f0af5de2d0ad5447ee68089736d8d36
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdefense_evasiondiscoveryexecutionpersistencepyinstallerspywarestealer

Malware Config

Targets

    • Target
      Chrome.exe
    • Size 27.2MB
    • SHA256 0cd3361f85a665218e9d5ee58820fad95f0af5de2d0ad5447ee68089736d8d36
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks