b85d531ed5d49739584d007dd7ce9119fac23310d747c0059b6232fe45e1bac6 | Triage

Sharing

General

Target

b85d531ed5d49739584d007dd7ce9119fac23310d747c0059b6232fe45e1bac6
Size

336KB
Sample

220919-t4za2sgha9
MD5

b4a28df4a80eb987b3c0f3cc8c6eb4a3
SHA1

fc59a90f4f67ebcc94f20307691b53172404913a
SHA256

b85d531ed5d49739584d007dd7ce9119fac23310d747c0059b6232fe45e1bac6
SHA512

091ad5870adbcc6f81cd8f91ebba5220fcff33f1ea0f0747aaba2eb86688463e8ec6d61db835b8b8cf7ef4d47687f9598147eb54fd8350ff41b4308ba533e8d5
SSDEEP

6144:b1dlZro5y3+P/gE31h42tx4djs2y48//Y9oi/jd/Q4FrmVgS9e7:b1dlZo5y3+P/S2tgyXYmiC4FrmHU7

Score

8^/10

adware persistence stealer

Malware Config

Targets

- Target
  
  b85d531ed5d49739584d007dd7ce9119fac23310d747c0059b6232fe45e1bac6
- Size
  
  336KB
- MD5
  
  b4a28df4a80eb987b3c0f3cc8c6eb4a3
- SHA1
  
  fc59a90f4f67ebcc94f20307691b53172404913a
- SHA256
  
  b85d531ed5d49739584d007dd7ce9119fac23310d747c0059b6232fe45e1bac6
- SHA512
  
  091ad5870adbcc6f81cd8f91ebba5220fcff33f1ea0f0747aaba2eb86688463e8ec6d61db835b8b8cf7ef4d47687f9598147eb54fd8350ff41b4308ba533e8d5
- SSDEEP
  
  6144:b1dlZro5y3+P/gE31h42tx4djs2y48//Y9oi/jd/Q4FrmVgS9e7:b1dlZo5y3+P/S2tgyXYmiC4FrmHU7
Score

8^/10

adware persistence stealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealer

behavioral2

adwarepersistencestealer