Overview

overview

10

Static

static

cec14b9fde...34.exe

windows7-x64

10

cec14b9fde...34.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cec14b9fde5a10e0d424e604433097ef9550eaf42fc4ec9f3193775734040c34

  • Size

    356KB

  • Sample

    221011-lp8beagfa2

  • MD5

    2953a780d5e58ed3032e2d36377a3f7c

  • SHA1

    559039c1f610299b0e303c4e843b012e42fb082e

  • SHA256

    cec14b9fde5a10e0d424e604433097ef9550eaf42fc4ec9f3193775734040c34

  • SHA512

    b91e978fbe96e4de41371247eb94a07b76d59b3425777506aa5231b5ee00daf448f6f39b027801c1249231121afced0abe56bfa500b84e7ce777ff46a867c7c7

  • SSDEEP

    6144:JecvgjhQMWekPQRacktlIgAm75bOvGmbPUMp3l8gUAq1urdA:JeVOMWbQRCybM6BqIA

Score
10/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      cec14b9fde5a10e0d424e604433097ef9550eaf42fc4ec9f3193775734040c34

    • Size

      356KB

    • MD5

      2953a780d5e58ed3032e2d36377a3f7c

    • SHA1

      559039c1f610299b0e303c4e843b012e42fb082e

    • SHA256

      cec14b9fde5a10e0d424e604433097ef9550eaf42fc4ec9f3193775734040c34

    • SHA512

      b91e978fbe96e4de41371247eb94a07b76d59b3425777506aa5231b5ee00daf448f6f39b027801c1249231121afced0abe56bfa500b84e7ce777ff46a867c7c7

    • SSDEEP

      6144:JecvgjhQMWekPQRacktlIgAm75bOvGmbPUMp3l8gUAq1urdA:JeVOMWbQRCybM6BqIA

    Score
    10/10
    evasionpersistencespywarestealer

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks