c7a114e54e2ce52679d4939e9157cded41182dbe9f4972202e4aee52704ac598 | Triage

Sharing

General

Target

c7a114e54e2ce52679d4939e9157cded41182dbe9f4972202e4aee52704ac598
Size

494KB
Sample

221030-ck634sgdc4
MD5

83f046f6f230a07eab101ed3331344f0
SHA1

96b3f91c5078aa888e5891b7ec6535f0f3549d9c
SHA256

c7a114e54e2ce52679d4939e9157cded41182dbe9f4972202e4aee52704ac598
SHA512

fe0bf74b3d024bdd4223e16579923d9ae3b677fa11f5e625147cda79ea08376b040387a25b1317e205ceed4d537659de3b88ec68a9ff2a31a169aa0c8974062b
SSDEEP

12288:gKd82tx6ZWoLX6sg8v4h3HMVt30pgz70B+YqykNuc:jhsxLXRY3sV67Fkl

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  c7a114e54e2ce52679d4939e9157cded41182dbe9f4972202e4aee52704ac598
- Size
  
  494KB
- MD5
  
  83f046f6f230a07eab101ed3331344f0
- SHA1
  
  96b3f91c5078aa888e5891b7ec6535f0f3549d9c
- SHA256
  
  c7a114e54e2ce52679d4939e9157cded41182dbe9f4972202e4aee52704ac598
- SHA512
  
  fe0bf74b3d024bdd4223e16579923d9ae3b677fa11f5e625147cda79ea08376b040387a25b1317e205ceed4d537659de3b88ec68a9ff2a31a169aa0c8974062b
- SSDEEP
  
  12288:gKd82tx6ZWoLX6sg8v4h3HMVt30pgz70B+YqykNuc:jhsxLXRY3sV67Fkl
Score

10^/10

evasion persistence spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Hidden Files and Directories

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealertrojan

behavioral2

evasionpersistencespywarestealertrojan