Overview

overview

10

Static

static

b4af64ddbe...89.exe

windows7-x64

10

b4af64ddbe...89.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b4af64ddbed43bcf8e05d3443f678f7dabf9b866637291837deb0df276770189

  • Size

    726KB

  • Sample

    221011-nppkeacdd8

  • MD5

    0476485fd30fa41429d7b90b40704bc0

  • SHA1

    2aec572606f456c18f260bdc4b420ff573364edf

  • SHA256

    b4af64ddbed43bcf8e05d3443f678f7dabf9b866637291837deb0df276770189

  • SHA512

    3fb1c3bff52f742ad7bc486e804595f644df992987935587e093464a7ae455ea35ccc3712e89dfa2aa9c04d4e7b20330fe03075630325feec69d5968750e7d80

  • SSDEEP

    12288:0zAcfrxt4Cxdp5ilzwRpToCatlA8pXIFtKRsIaJRT7hVjNZVVSrfmN6kOMGFELC1:Wxxt4CxHMlzwRB3xtKRsIcRT7hJNZPSh

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      b4af64ddbed43bcf8e05d3443f678f7dabf9b866637291837deb0df276770189

    • Size

      726KB

    • MD5

      0476485fd30fa41429d7b90b40704bc0

    • SHA1

      2aec572606f456c18f260bdc4b420ff573364edf

    • SHA256

      b4af64ddbed43bcf8e05d3443f678f7dabf9b866637291837deb0df276770189

    • SHA512

      3fb1c3bff52f742ad7bc486e804595f644df992987935587e093464a7ae455ea35ccc3712e89dfa2aa9c04d4e7b20330fe03075630325feec69d5968750e7d80

    • SSDEEP

      12288:0zAcfrxt4Cxdp5ilzwRpToCatlA8pXIFtKRsIaJRT7hVjNZVVSrfmN6kOMGFELC1:Wxxt4CxHMlzwRB3xtKRsIcRT7hJNZPSh

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks