Overview

overview

9

Static

static

98e3304a43...74.exe

windows7_x64

9

98e3304a43...74.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74

  • Size

    386KB

  • Sample

    210411-dfm9jwhhne

  • MD5

    f6587e051ff9bf2e20825470ae5b3775

  • SHA1

    9b28d1e6cbff6b1397712a49c540b2ef999d78bc

  • SHA256

    98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74

  • SHA512

    b3cd1c3577fac05cf318cb8c4a34f6afb3a44e0abe2e2bfc81ca246e503e0c9ac3daac794c87993f3eac82859b6692ae31bfe618a11099f87e5fd5a731950626

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74

    • Size

      386KB

    • MD5

      f6587e051ff9bf2e20825470ae5b3775

    • SHA1

      9b28d1e6cbff6b1397712a49c540b2ef999d78bc

    • SHA256

      98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74

    • SHA512

      b3cd1c3577fac05cf318cb8c4a34f6afb3a44e0abe2e2bfc81ca246e503e0c9ac3daac794c87993f3eac82859b6692ae31bfe618a11099f87e5fd5a731950626

    Score
    9/10
    ransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

3
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3
T1490

Tasks