3f7b2ee83bf23996feb13de66959927ec6fc7fabc2ae2fa82abeef0ed26b48fb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3f7b2ee83bf23996feb13de66959927ec6fc7fabc2ae2fa82abeef0ed26b48fb
Size

73KB
Sample

221106-12exysfgdj
MD5

0e2c2ecc04afe981d200dd76d79111a1
SHA1

ca43d361c7b0d406e4f9e6806f0969ffd5d7e3c1
SHA256

3f7b2ee83bf23996feb13de66959927ec6fc7fabc2ae2fa82abeef0ed26b48fb
SHA512

a9f2ad0a511609a09e303165c2ea8e009ecfacc3c175647201887ff0c8bec545a46288c379eb2465fdeed36bc503fe6cc3dffff9390b9b7b0fcbbfcdf564994f
SSDEEP

1536:Lwql7JmQ9g7fM63UQwjMMlt/sNCmxd8lPKzYIC1mfXcp:uBjM633wjM2t/8CmCKxC14sp

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  3f7b2ee83bf23996feb13de66959927ec6fc7fabc2ae2fa82abeef0ed26b48fb
- Size
  
  73KB
- MD5
  
  0e2c2ecc04afe981d200dd76d79111a1
- SHA1
  
  ca43d361c7b0d406e4f9e6806f0969ffd5d7e3c1
- SHA256
  
  3f7b2ee83bf23996feb13de66959927ec6fc7fabc2ae2fa82abeef0ed26b48fb
- SHA512
  
  a9f2ad0a511609a09e303165c2ea8e009ecfacc3c175647201887ff0c8bec545a46288c379eb2465fdeed36bc503fe6cc3dffff9390b9b7b0fcbbfcdf564994f
- SSDEEP
  
  1536:Lwql7JmQ9g7fM63UQwjMMlt/sNCmxd8lPKzYIC1mfXcp:uBjM633wjM2t/8CmCKxC14sp
Score

8^/10

persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer