Overview

overview

8

Static

static

9ed0f76449...b7.exe

windows10-1703-x64

8

9ed0f76449...b7.exe

windows10-2004-x64

8

Resubmissions

15-10-2022 22:26

221015-2ckbtagec3 8

15-10-2022 22:06

221015-1z52csgcgk 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7

  • Size

    162KB

  • Sample

    221015-2ckbtagec3

  • MD5

    b08793eadfa6dd535f68e4f67c43e5c0

  • SHA1

    f952c86957f37022ce8ba1cab0c02fb262b74f76

  • SHA256

    9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7

  • SHA512

    62ad843c1c98dd270bddba6ff73022e2eae00ff5fcebb93b51e1b63da21fc1ae3124e11c063c655e8c3a13dda070bc25c9db20efbda556a397a294f49a9b3f63

  • SSDEEP

    3072:fnhp3kRaJdl8kLz7AuICdiRgrJpBPEg/GXib7VkR4OatVj:f3audlbcdRKJpBPEg/GXib6i

Score
8/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7

    • Size

      162KB

    • MD5

      b08793eadfa6dd535f68e4f67c43e5c0

    • SHA1

      f952c86957f37022ce8ba1cab0c02fb262b74f76

    • SHA256

      9ed0f76449bbc6d5d6db12dfc527740c072436c4379248855729321032d91bb7

    • SHA512

      62ad843c1c98dd270bddba6ff73022e2eae00ff5fcebb93b51e1b63da21fc1ae3124e11c063c655e8c3a13dda070bc25c9db20efbda556a397a294f49a9b3f63

    • SSDEEP

      3072:fnhp3kRaJdl8kLz7AuICdiRgrJpBPEg/GXib7VkR4OatVj:f3audlbcdRKJpBPEg/GXib6i

    Score
    8/10
    discoveryspywarestealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks