Overview

overview

10

Static

static

6

22D1F555S0...1S.vbs

windows7_x64

8

22D1F555S0...1S.vbs

windows10_x64

8

~.exe

windows7_x64

10

~.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22D1F555S00DF22S1F44AAA5D1S.zip

  • Size

    938KB

  • Sample

    201102-t5hls3g6a6

  • MD5

    8544bcf75da484d41c1d4126d6f3c397

  • SHA1

    3fbab06c8f4cd3ed83cc4a55df0aa798bd314069

  • SHA256

    b2fb41e4af3cd80f10c4748092614c63bfc0822adcbbd9f067c6080dbf0a91c7

  • SHA512

    3773b36ce1f2c3376391071cbe74f7915e0743ba9dd2e830c704d25a34dbfdc9fe0a15c6565fa211608e4a232d30cfc0076150c6188dcfc07ef1c4ea90419dde

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      22D1F555S00DF22S1F44AAA5D1S.vbs

    • Size

      8KB

    • MD5

      446248fb432b6176adb80fc78af38e99

    • SHA1

      aa67f6ce66f6bc9fa079e17463e61c6dc81cf901

    • SHA256

      e5f3d038b558d021ad49a0f1385e00f8b63d947f7a4b6cafad308968ddf21780

    • SHA512

      c6e789bb2d6b7b2e2af409e80eff024746d126588d856f172838978cbec9ea64caa7a2c6d4149bbe3c1573e35180ed0508c31a57e597069a9a2c4b9a190fe2c8

    Score
    8/10

    • Blocklisted process makes network request

    behavioral1behavioral2

    • Target

      ~

    • Size

      2.0MB

    • MD5

      ebe3aa6a70fac4e32a072f4ad21cff3d

    • SHA1

      e1a41eed4f49e43f098e15b7620bf7af1c025a93

    • SHA256

      df0a4fbebae6d6ae7150d70c96024a55712b6ce0aec82fa2fe23ea85b95a973d

    • SHA512

      6f01d6f4fac7bc18f7cdff31717b2d2faa3b4dbddb2938bec507672f32693a6620bf21ac0f8310fb162b60c0f50364e3c7f7b8c770bf0c03269a4d5c3e546418

    Score
    10/10
    adwarepersistencestealerupx

    • Registers COM server for autorun

      persistence

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks