Overview

overview

10

Static

static

2050.exe

windows7_x64

8

2050.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2050.exe

  • Size

    3.7MB

  • Sample

    200708-p844gjfl5j

  • MD5

    67a58e0cd56c1347fdb8dfd6daa163c9

  • SHA1

    e57cddf1375f1124aab526bb37a7ba74876353aa

  • SHA256

    1eb6e921f6045c1ea7cb304d9b7108c653424f7b3cbb9ec63bcec4d8998bd98c

  • SHA512

    666d61b53424e4ed7cc0503b83f85b979fe7a9d66ad3be25b7218f8c1ece98f21d459025224a42015ef1ffce1468fda4272c16e575b80f4f8d6d55c1f2e73519

Score
10/10
evasionspywaretrojan

Malware Config

Targets

    • Target

      2050.exe

    • Size

      3.7MB

    • MD5

      67a58e0cd56c1347fdb8dfd6daa163c9

    • SHA1

      e57cddf1375f1124aab526bb37a7ba74876353aa

    • SHA256

      1eb6e921f6045c1ea7cb304d9b7108c653424f7b3cbb9ec63bcec4d8998bd98c

    • SHA512

      666d61b53424e4ed7cc0503b83f85b979fe7a9d66ad3be25b7218f8c1ece98f21d459025224a42015ef1ffce1468fda4272c16e575b80f4f8d6d55c1f2e73519

    Score
    10/10
    evasionspywaretrojan

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Enumerates connected drives

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies system certificate store

      evasionspywaretrojan

    • Program crash

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks