Overview

overview

10

Static

static

8

3413038a38...11.exe

windows7_x64

10

3413038a38...11.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3413038a38445e1b976db07935a8f0b4dbb95cbed6dc7afe25734c10f9292511

  • Size

    719KB

  • Sample

    210517-y9cd82mp1s

  • MD5

    859b8e76d5e0e7d1cbbf659f27f642ad

  • SHA1

    9a0917bbc7224a4b965a48d4e5251c2e86bb6a6f

  • SHA256

    3413038a38445e1b976db07935a8f0b4dbb95cbed6dc7afe25734c10f9292511

  • SHA512

    7a1780bd5e97f93f8de2145eef1d13a5e9319cf253f1010d1b501d94d7e3758e3365ad99f7f56321a45c8ef90d7dc47c961fe8d4d406d4ad669ac8d3868a67d7

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      3413038a38445e1b976db07935a8f0b4dbb95cbed6dc7afe25734c10f9292511

    • Size

      719KB

    • MD5

      859b8e76d5e0e7d1cbbf659f27f642ad

    • SHA1

      9a0917bbc7224a4b965a48d4e5251c2e86bb6a6f

    • SHA256

      3413038a38445e1b976db07935a8f0b4dbb95cbed6dc7afe25734c10f9292511

    • SHA512

      7a1780bd5e97f93f8de2145eef1d13a5e9319cf253f1010d1b501d94d7e3758e3365ad99f7f56321a45c8ef90d7dc47c961fe8d4d406d4ad669ac8d3868a67d7

    Score
    10/10
    adwarepersistencestealer

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2
T1004

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks