Overview

overview

10

Static

static

3

TOOL.exe

windows7_x64

7

TOOL.exe

windows10_x64

10

Resubmissions

24-07-2021 10:45

210724-phtf8r61la 10

07-09-2020 13:45

200907-tlde9xx29n 7

06-09-2020 10:57

200906-apz15m223e 7

06-09-2020 07:55

200906-2zwlc6b7h2 8

06-09-2020 07:51

200906-h9pa71e62a 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TOOL.exe

  • Size

    15.3MB

  • Sample

    210724-phtf8r61la

  • MD5

    42c3370a6bdc0bd641bf0583cef3cfe2

  • SHA1

    33fea4db9b6a1fd9167f4bfa5abad4c0c86f6b58

  • SHA256

    8d025c8034092b69331f21684eaeee9ebf1d3b4db491997f857b9b1a233b2ef5

  • SHA512

    628eaac733723b2f371182c0fd017e558859d15fc32077a0abf04fc7b82e6e8c1a53e6ed5ba85467bce63bdfeff9b23b7f09c342c0e744ffdd3307ee9037975d

Score
10/10
persistencepyinstallerspywarestealer

Malware Config

Targets

    • Target

      TOOL.exe

    • Size

      15.3MB

    • MD5

      42c3370a6bdc0bd641bf0583cef3cfe2

    • SHA1

      33fea4db9b6a1fd9167f4bfa5abad4c0c86f6b58

    • SHA256

      8d025c8034092b69331f21684eaeee9ebf1d3b4db491997f857b9b1a233b2ef5

    • SHA512

      628eaac733723b2f371182c0fd017e558859d15fc32077a0abf04fc7b82e6e8c1a53e6ed5ba85467bce63bdfeff9b23b7f09c342c0e744ffdd3307ee9037975d

    Score
    10/10
    persistencespywarestealer

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks