Overview

overview

10

Static

static

70818ab8a3...a6.exe

windows7_x64

8

70818ab8a3...a6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70818ab8a38bcb65be92612c6e7304d3927315058eb16a31ec4dc44ee4b3f6a6

  • Size

    1.0MB

  • Sample

    210511-plkm9e86es

  • MD5

    30fd7fadaf2d351f849d841bb15bbc7d

  • SHA1

    8c3d626dd7f709a4a5376b7272937afbe21757fa

  • SHA256

    70818ab8a38bcb65be92612c6e7304d3927315058eb16a31ec4dc44ee4b3f6a6

  • SHA512

    21501348b7b04d9b42709eb899ee63bb78c2217b95a4693f494921b08e4ff01aaffa67da5c0829e99ed7b4a921ae323d7cdb21d6da2480806f605f6b0864ce4c

Score
10/10
discoveryevasionmacropersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      70818ab8a38bcb65be92612c6e7304d3927315058eb16a31ec4dc44ee4b3f6a6

    • Size

      1.0MB

    • MD5

      30fd7fadaf2d351f849d841bb15bbc7d

    • SHA1

      8c3d626dd7f709a4a5376b7272937afbe21757fa

    • SHA256

      70818ab8a38bcb65be92612c6e7304d3927315058eb16a31ec4dc44ee4b3f6a6

    • SHA512

      21501348b7b04d9b42709eb899ee63bb78c2217b95a4693f494921b08e4ff01aaffa67da5c0829e99ed7b4a921ae323d7cdb21d6da2480806f605f6b0864ce4c

    Score
    10/10
    discoveryevasionpersistencespywarestealertrojanupxmacro

    • Registers COM server for autorun

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks