a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4 | Triage

Submit
Reports

Overview

overview

Static

static

a1c3e1f6e6...b4.exe

windows7_x64

a1c3e1f6e6...b4.exe

windows10-2004_x64

Sharing

General

Target

a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4
Size

1.8MB
Sample

220322-p7hp9afbb6
MD5

3a58fb8bddcd783603cd2db060bb393c
SHA1

9322cb54e34843470ac96a70b475c1e3beaa21a1
SHA256

a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4
SHA512

eefedae8e6273910931eefe05eb6530d6e4790b116e69cf37717c467eaba43074dda3fc34e84ab6dcc92dee8ac93aa41d95a5314066ffb7d68a5ca01ad445b7c

Score

10^/10

discovery evasion persistence spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4.exe

Resource

win7-20220311-en

evasion persistence trojan

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4.exe

Resource

win10v2004-en-20220113

discovery evasion persistence spyware stealer trojan

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4
- Size
  
  1.8MB
- MD5
  
  3a58fb8bddcd783603cd2db060bb393c
- SHA1
  
  9322cb54e34843470ac96a70b475c1e3beaa21a1
- SHA256
  
  a1c3e1f6e6b81321e3cf866d05f5b19987203bcd576e9e3e2398641490f0bfb4
- SHA512
  
  eefedae8e6273910931eefe05eb6530d6e4790b116e69cf37717c467eaba43074dda3fc34e84ab6dcc92dee8ac93aa41d95a5314066ffb7d68a5ca01ad445b7c
Score

10^/10

evasion persistence trojan discovery spyware stealer
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Scheduled Task

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

discoveryevasionpersistencespywarestealertrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.