Overview

overview

8

Static

static

3

c299cc09ab...bb.exe

windows7_x64

8

c299cc09ab...bb.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb

  • Size

    5.2MB

  • Sample

    220516-cj3djahhc9

  • MD5

    1602e66dbf6c6d9d42fff718a0bdc84e

  • SHA1

    4fff705808153dd10f5a4d0622f5356634c72084

  • SHA256

    c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb

  • SHA512

    fff54e662ae1f753070781d0330d41276eafda1b25b3bd2bd478656fb28561c534b3a73723a2273917e3f4df9307dc9b35ae107966369cf8705ac4220c6a74a0

Score
8/10
persistencepyinstallerspywarestealer

Malware Config

Targets

    • Target

      c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb

    • Size

      5.2MB

    • MD5

      1602e66dbf6c6d9d42fff718a0bdc84e

    • SHA1

      4fff705808153dd10f5a4d0622f5356634c72084

    • SHA256

      c299cc09abfb6ae932031148e8726680d8935cba50bf6661bb6ed21fcb1801bb

    • SHA512

      fff54e662ae1f753070781d0330d41276eafda1b25b3bd2bd478656fb28561c534b3a73723a2273917e3f4df9307dc9b35ae107966369cf8705ac4220c6a74a0

    Score
    8/10
    persistencespywarestealer

    • Drops file in Drivers directory

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks