Overview

overview

8

Static

static

1

d17c510c87...e4.exe

windows7-x64

8

d17c510c87...e4.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d17c510c87e9f4eab14a145404df2d7953acd1fc19ec08cdf946279ff5d733e4

  • Size

    1.8MB

  • Sample

    221123-xn5dxafe99

  • MD5

    f819f00375b7314af393b8c8545374f2

  • SHA1

    55835a13e59d24d17d6ea2273070e698f01a12c3

  • SHA256

    d17c510c87e9f4eab14a145404df2d7953acd1fc19ec08cdf946279ff5d733e4

  • SHA512

    15552dfd99e37c3ed94f36c28a5be41b1db2d21daf6b0dfcc2f5b202fb5315fb7f00bda4f1a7a1d7daf6e386675703fd6716002b916135af8f26c68b3039bdf8

  • SSDEEP

    49152:lnwJte53FoqI+qOGYdU3YNTMXQkwk67sFnpD5yv2nwu:lnwJ5+qOtdUoFMUh7antUv2nwu

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      d17c510c87e9f4eab14a145404df2d7953acd1fc19ec08cdf946279ff5d733e4

    • Size

      1.8MB

    • MD5

      f819f00375b7314af393b8c8545374f2

    • SHA1

      55835a13e59d24d17d6ea2273070e698f01a12c3

    • SHA256

      d17c510c87e9f4eab14a145404df2d7953acd1fc19ec08cdf946279ff5d733e4

    • SHA512

      15552dfd99e37c3ed94f36c28a5be41b1db2d21daf6b0dfcc2f5b202fb5315fb7f00bda4f1a7a1d7daf6e386675703fd6716002b916135af8f26c68b3039bdf8

    • SSDEEP

      49152:lnwJte53FoqI+qOGYdU3YNTMXQkwk67sFnpD5yv2nwu:lnwJ5+qOtdUoFMUh7antUv2nwu

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks