General
- Target mpclient.dll.exe
- Size 3.5MB
- Sample260625-e9mf4shs6v
- SHA256 9007698a67964ef5f647ae478ad2b4d6e6b940428ebb86ef22b8d746fd6b8d0a
Score
10/10
Malware Config
Targets
-
- Target mpclient.dll.exe
- Size 3.5MB
- SHA256 9007698a67964ef5f647ae478ad2b4d6e6b940428ebb86ef22b8d746fd6b8d0a
Score10/10Suspicious use of NtCreateProcessExOtherParentProcess
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1