Overview

overview

9

Static

static

1

04726c70e8...77.exe

windows7_x64

9

04726c70e8...77.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04726c70e8ab37d0096828921ab4fd3de865a00c78abe2bc80e6604c1699ba77

  • Size

    533KB

  • Sample

    220527-zwlmwacfb7

  • MD5

    7e2ddacb41137653159ea25311c8210f

  • SHA1

    388dfe57996bf490be10152e32cc739ca93c3754

  • SHA256

    04726c70e8ab37d0096828921ab4fd3de865a00c78abe2bc80e6604c1699ba77

  • SHA512

    62ff7890e9922c7ce96bb0349710d64101431ba12e9be50033b11a438b9a7c340cea472b7615cebe8aa3f3f462a5b14c6fd04b13668cc0ce35b3727735d70ec3

Score
9/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      04726c70e8ab37d0096828921ab4fd3de865a00c78abe2bc80e6604c1699ba77

    • Size

      533KB

    • MD5

      7e2ddacb41137653159ea25311c8210f

    • SHA1

      388dfe57996bf490be10152e32cc739ca93c3754

    • SHA256

      04726c70e8ab37d0096828921ab4fd3de865a00c78abe2bc80e6604c1699ba77

    • SHA512

      62ff7890e9922c7ce96bb0349710d64101431ba12e9be50033b11a438b9a7c340cea472b7615cebe8aa3f3f462a5b14c6fd04b13668cc0ce35b3727735d70ec3

    Score
    9/10
    adwarepersistencestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks