Overview

overview

8

Static

static

5c69d7e04e...7c.exe

windows7-x64

8

5c69d7e04e...7c.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c

  • Size

    3.5MB

  • Sample

    221123-vmnnnahd82

  • MD5

    1891fd26b6e7a71c7e20521645832348

  • SHA1

    6830ed68176c916e272c1933bd1f62060bc7ade5

  • SHA256

    5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c

  • SHA512

    2ddcbad0057c193afa6f58b0183a3f74085a8db348b37e49bd0c956d2f5e0a21322b622fd70fa9bd0fc25cd5b36c0b80a4c121a837f3615b5f962fd52feeecbf

  • SSDEEP

    49152:fnRlx6HPIwOEZm37NkR6hnl9nkyb3BeZit0Q87sovWY5i8LnA/wlnrgwqy91MgcL:vvx6HGUeEit98YEWYdLnAKn0wkg

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c

    • Size

      3.5MB

    • MD5

      1891fd26b6e7a71c7e20521645832348

    • SHA1

      6830ed68176c916e272c1933bd1f62060bc7ade5

    • SHA256

      5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c

    • SHA512

      2ddcbad0057c193afa6f58b0183a3f74085a8db348b37e49bd0c956d2f5e0a21322b622fd70fa9bd0fc25cd5b36c0b80a4c121a837f3615b5f962fd52feeecbf

    • SSDEEP

      49152:fnRlx6HPIwOEZm37NkR6hnl9nkyb3BeZit0Q87sovWY5i8LnA/wlnrgwqy91MgcL:vvx6HGUeEit98YEWYdLnAKn0wkg

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks