513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

513adfc4da...c4.exe

windows7-x64

8

513adfc4da...c4.exe

windows10-2004-x64

8

Sharing

General

Target

513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4
Size

301KB
Sample

221001-2p9r8safg4
MD5

77d0ce0683aa2f27c161f1c1c3ac87f4
SHA1

f9c6f8db507e5ae9e7ee3bce6682d2310b31b7da
SHA256

513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4
SHA512

1d3267aaa1e84038c2b833dec662aaac272709985bf0b120dd66606eb299bba9ea95940d6b51eedbf3f14f011ce6f6c69fcc37fd3efc80f1ecd36efa5fb9401c
SSDEEP

6144:NCjVktZuPRDf+cxRPxEYhBHStiVuU9r8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PA:NCjutZu5Dm27HStVMr8wYbF0wp3kskcX

Score

8^/10

adware evasion stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe

Resource

win7-20220812-en

adware evasion stealer trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe

Resource

win10v2004-20220812-en

adware evasion stealer trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4
- Size
  
  301KB
- MD5
  
  77d0ce0683aa2f27c161f1c1c3ac87f4
- SHA1
  
  f9c6f8db507e5ae9e7ee3bce6682d2310b31b7da
- SHA256
  
  513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4
- SHA512
  
  1d3267aaa1e84038c2b833dec662aaac272709985bf0b120dd66606eb299bba9ea95940d6b51eedbf3f14f011ce6f6c69fcc37fd3efc80f1ecd36efa5fb9401c
- SSDEEP
  
  6144:NCjVktZuPRDf+cxRPxEYhBHStiVuU9r8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PA:NCjutZu5Dm27HStVMr8wYbF0wp3kskcX
Score

8^/10

adware evasion stealer trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwareevasionstealertrojan

behavioral2

adwareevasionstealertrojan

© 2018-2025

Terms | Privacy