74f5b09b4cfcad6bc0b9d6965843d92489692a2344ccb9bdbddb96b4e23ea3ad | Triage

Sharing

Copy URL Twitter E-mail

General

Target

74f5b09b4cfcad6bc0b9d6965843d92489692a2344ccb9bdbddb96b4e23ea3ad
Size

388KB
Sample

221003-kkrbnafeb6
MD5

6da20b14a10763a2aac10e44b1369c3a
SHA1

2855bab0da612e2010ab5efe4ba32a545eff7d21
SHA256

74f5b09b4cfcad6bc0b9d6965843d92489692a2344ccb9bdbddb96b4e23ea3ad
SHA512

46cee2726285eb098a3f593de097f469506204cc37ce5f2cd0f91b59223a5424ff0f834e454060b384e261a9af9286a9fbc3246feb3c6b8098e604d3945590c7
SSDEEP

12288:MvAPUD3Bk0Mr9Vif7/F1hIIaYHuvAIS26:MvtvMpVij/F1hV5HuvAIk

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  74f5b09b4cfcad6bc0b9d6965843d92489692a2344ccb9bdbddb96b4e23ea3ad
- Size
  
  388KB
- MD5
  
  6da20b14a10763a2aac10e44b1369c3a
- SHA1
  
  2855bab0da612e2010ab5efe4ba32a545eff7d21
- SHA256
  
  74f5b09b4cfcad6bc0b9d6965843d92489692a2344ccb9bdbddb96b4e23ea3ad
- SHA512
  
  46cee2726285eb098a3f593de097f469506204cc37ce5f2cd0f91b59223a5424ff0f834e454060b384e261a9af9286a9fbc3246feb3c6b8098e604d3945590c7
- SSDEEP
  
  12288:MvAPUD3Bk0Mr9Vif7/F1hIIaYHuvAIS26:MvtvMpVij/F1hV5HuvAIk
Score

8^/10

persistence spyware stealer
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer