Overview

overview

10

Static

static

9537641140...6f.exe

windows7-x64

10

9537641140...6f.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    9537641140257d5bc95926c4eddc39be874941655968062e7f333e0f650d026f

  • Size

    92KB

  • Sample

    221107-skprtsdbc7

  • MD5

    0e39d984e872e27fb6c99150905e2450

  • SHA1

    71d6d2fe6ebc6cc4432cd38d9a10ed834664c572

  • SHA256

    9537641140257d5bc95926c4eddc39be874941655968062e7f333e0f650d026f

  • SHA512

    9238eef8b0d7ce0c9ceca9599b79e9b3126675329b6c1c806e148b7f12354318c0a0d47a64a07f9f05e00ece8dc78b84ca4b6975e2adfaab4306741c244256cc

  • SSDEEP

    1536:qg8QVkFLShITdcjp0vnAhJjeE0PxmkFs60Upm/7c5hnHTSF20Hle32bWtajXnCj:F8qkFMIG1wYwEuXjpmDc/HOWte3C

Score
10/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      9537641140257d5bc95926c4eddc39be874941655968062e7f333e0f650d026f

    • Size

      92KB

    • MD5

      0e39d984e872e27fb6c99150905e2450

    • SHA1

      71d6d2fe6ebc6cc4432cd38d9a10ed834664c572

    • SHA256

      9537641140257d5bc95926c4eddc39be874941655968062e7f333e0f650d026f

    • SHA512

      9238eef8b0d7ce0c9ceca9599b79e9b3126675329b6c1c806e148b7f12354318c0a0d47a64a07f9f05e00ece8dc78b84ca4b6975e2adfaab4306741c244256cc

    • SSDEEP

      1536:qg8QVkFLShITdcjp0vnAhJjeE0PxmkFs60Upm/7c5hnHTSF20Hle32bWtajXnCj:F8qkFMIG1wYwEuXjpmDc/HOWte3C

    Score
    10/10
    evasionpersistencespywarestealer

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks