Overview

overview

10

Static

static

reimagerepair.exe

windows7_x64

10

reimagerepair.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    reimagerepair.exe

  • Size

    750KB

  • Sample

    200716-dn43mbw1wj

  • MD5

    d729e0726f77304b299085afba059b5f

  • SHA1

    45e7449f1a82158b429be44611ae49bcefdab6e1

  • SHA256

    ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41

  • SHA512

    c02e66fad7187abba46fbbb61386023166fb2d8b83c443bc78e7f7bf2ea28fe7bd3d2a2ddf1c501cd26e42d78eecba99b19b64ca541e653eedd1d9db07ae2f8a

Score
10/10
discoverypersistencespyware

Malware Config

Targets

    • Target

      reimagerepair.exe

    • Size

      750KB

    • MD5

      d729e0726f77304b299085afba059b5f

    • SHA1

      45e7449f1a82158b429be44611ae49bcefdab6e1

    • SHA256

      ec67e8947166fd22f79c54588b11697513e9e0d79f42cf9f52b8e51ff8577f41

    • SHA512

      c02e66fad7187abba46fbbb61386023166fb2d8b83c443bc78e7f7bf2ea28fe7bd3d2a2ddf1c501cd26e42d78eecba99b19b64ca541e653eedd1d9db07ae2f8a

    Score
    10/10
    persistencediscoveryspyware

    • Registers COM server for autorun

      persistence

    • Executes dropped EXE

    • Uses Session Manager for persistence

      Creates Session Manager registry key to run executable early in system boot.

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

    • JavaScript code in executable

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks