Overview

overview

10

Static

static

safeconnect.exe

windows7_x64

10

safeconnect.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    safeconnect.exe

  • Size

    721KB

  • Sample

    211216-gmgy8abch2

  • MD5

    3b89d22f1d594573f2957c942f43d730

  • SHA1

    0c6edad332f7fdc73ba4d51a3751d8185230bb27

  • SHA256

    66ef5da13e960e2878af2820f76fc8b258359d1a990d9061f5cf43bf8f8329b0

  • SHA512

    43edbb57b298e83ac610714013e032d5b495485dc888638ee9cbf1ebc3f8a7beffd542cf7b37ecaba336363a7d7abe9cc033c4ca78d6d1ffe5fec6f8272ff0fe

Score
10/10
adwareevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      safeconnect.exe

    • Size

      721KB

    • MD5

      3b89d22f1d594573f2957c942f43d730

    • SHA1

      0c6edad332f7fdc73ba4d51a3751d8185230bb27

    • SHA256

      66ef5da13e960e2878af2820f76fc8b258359d1a990d9061f5cf43bf8f8329b0

    • SHA512

      43edbb57b298e83ac610714013e032d5b495485dc888638ee9cbf1ebc3f8a7beffd542cf7b37ecaba336363a7d7abe9cc033c4ca78d6d1ffe5fec6f8272ff0fe

    Score
    10/10
    adwareevasionpersistencestealertrojan

    • Registers COM server for autorun

      persistence

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks