Overview

overview

8

Static

static

Draw.io _caMQZ.exe

windows7-x64

8

Draw.io _caMQZ.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MDE_File_Sample_43aa39e7c91122fac3ceff37278f878eb60df870 (1).zip

  • Size

    1.8MB

  • Sample

    221018-m8swhafed3

  • MD5

    3dc5814d9211b2ff8654bfee2c4b96e0

  • SHA1

    d66aa4a062d5b67aea0ce0c93ee598d8c39db6c4

  • SHA256

    f99e60e6baac68914020726d270c5d0da9597c9341e8bc6f50dd7436dac8bf64

  • SHA512

    9a4bee3bc10487ee8330ffb4ca830c75b908d46d63eef3b4ac096f496789b05eab8d2d42d414bdd9c03291008be493a662c4b0a77ed349c5bf0a6d4199c35802

  • SSDEEP

    49152:K0sEhSp873XG9BHHJHmAEh6EjhCuHJ3LV3SOKHlKGc:K0xC/9pHJVEhNjbp7tSOOkGc

Score
8/10
discoveryspywarestealer

Malware Config

Targets

    • Target

      Draw.io _caMQZ.exe

    • Size

      5.1MB

    • MD5

      5347d1465f1abfbe142bee26234c2d42

    • SHA1

      43aa39e7c91122fac3ceff37278f878eb60df870

    • SHA256

      3eeab0e2bbd7e74117cf4d36fa98a7d0125fc46161a1193f0b72fca297f5c8ac

    • SHA512

      afe6c2b058056813ef2f6642c5e4593c37bfc12b38f7f8990e3a923e56922a7c2647eb2e214d7da22de60648475bf59b2b3a9f4818f2861dbc37f9f8e10815bd

    • SSDEEP

      49152:nhvEwVL6q9TUDEYh8ESu07hZPKBmeSOlNUA2lEj6T6RSUvfkt9Y:1LVQYA08RSUnkt6

    Score
    8/10
    discoveryspywarestealer

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks