Overview

overview

10

Static

static

8

60cdc63e61...c5.exe

windows7_x64

10

60cdc63e61...c5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60cdc63e61337549aebfb887e4074efa6d67824be1f704fbec25149f67dbafc5

  • Size

    435KB

  • Sample

    210515-hm3yhqcp9j

  • MD5

    8b9ff2dc510fb2517f1c349d59053f7c

  • SHA1

    a72bd82c198915830266ea913d42486ff3655ea8

  • SHA256

    60cdc63e61337549aebfb887e4074efa6d67824be1f704fbec25149f67dbafc5

  • SHA512

    58490a2caa7640aa2bf9dc14925aaf7cb55dda9b83aaff60e450e1ac489da3a144fea24916426f5a2385e1dbe54de8a4efe7c6d84932bd02e28696ef85072919

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      60cdc63e61337549aebfb887e4074efa6d67824be1f704fbec25149f67dbafc5

    • Size

      435KB

    • MD5

      8b9ff2dc510fb2517f1c349d59053f7c

    • SHA1

      a72bd82c198915830266ea913d42486ff3655ea8

    • SHA256

      60cdc63e61337549aebfb887e4074efa6d67824be1f704fbec25149f67dbafc5

    • SHA512

      58490a2caa7640aa2bf9dc14925aaf7cb55dda9b83aaff60e450e1ac489da3a144fea24916426f5a2385e1dbe54de8a4efe7c6d84932bd02e28696ef85072919

    Score
    10/10
    adwarepersistencestealer

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks