Overview

overview

8

Static

static

0e443a7a69...9e.exe

windows7-x64

8

0e443a7a69...9e.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e

  • Size

    2.1MB

  • Sample

    221123-3shctsgd4v

  • MD5

    21c3ee0f2c56793156cb38d3a6f9f25a

  • SHA1

    e45fa461d65cc3809c5a3abbc2fb572b2fef5c97

  • SHA256

    0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e

  • SHA512

    fa375f6c3d3778ef91565543f27f95a8eb7d6797716487d05e1f5c03337c3cd191af257c220c84b468a4bbc1be55f3412bc202e3373e4c59d41d0603e6e24063

  • SSDEEP

    49152:h1OsIhvaZG1MVEtzijkTvu2x/uw4B8FHFF6Q:h1OhvaxMziy3h

Score
8/10
adwarediscoveryspywarestealer

Malware Config

Targets

    • Target

      0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e

    • Size

      2.1MB

    • MD5

      21c3ee0f2c56793156cb38d3a6f9f25a

    • SHA1

      e45fa461d65cc3809c5a3abbc2fb572b2fef5c97

    • SHA256

      0e443a7a69aa328a50d012796195c0a5faa2742de6927ad352ac7a176ff3e49e

    • SHA512

      fa375f6c3d3778ef91565543f27f95a8eb7d6797716487d05e1f5c03337c3cd191af257c220c84b468a4bbc1be55f3412bc202e3373e4c59d41d0603e6e24063

    • SSDEEP

      49152:h1OsIhvaZG1MVEtzijkTvu2x/uw4B8FHFF6Q:h1OhvaxMziy3h

    Score
    8/10
    adwarediscoveryspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks