Overview

overview

8

Static

static

1

d6a22844cc...7a.exe

windows7-x64

8

d6a22844cc...7a.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6a22844cc831a3c244bc9e0ad4f3be5351cd7c5a28c5425dd8640bc2446d47a

  • Size

    6.1MB

  • Sample

    221123-xnhvxafe66

  • MD5

    162c697a7742453a32217bc28bfb9e97

  • SHA1

    37c6301121159d220027294f2258561f986a9408

  • SHA256

    d6a22844cc831a3c244bc9e0ad4f3be5351cd7c5a28c5425dd8640bc2446d47a

  • SHA512

    7113ab0d9622ed7cae3ed8ad3e3eb2db8c93c8308136a066f8f65514c0f6b896aa32901dbf36f31eb33e18cba05d254a764cee72b2aba536f390c4ffb7244107

  • SSDEEP

    98304:Pu+lqUdMYTF3htapMLtg4QwwQ7FL9z8XBlyKMqrTGEli/azGdqzr1+VV2nvlU:PuCFdpF3htTLYwbz4ZTKqVBdU

Score
8/10
discoveryevasionspywarestealerupx

Malware Config

Targets

    • Target

      d6a22844cc831a3c244bc9e0ad4f3be5351cd7c5a28c5425dd8640bc2446d47a

    • Size

      6.1MB

    • MD5

      162c697a7742453a32217bc28bfb9e97

    • SHA1

      37c6301121159d220027294f2258561f986a9408

    • SHA256

      d6a22844cc831a3c244bc9e0ad4f3be5351cd7c5a28c5425dd8640bc2446d47a

    • SHA512

      7113ab0d9622ed7cae3ed8ad3e3eb2db8c93c8308136a066f8f65514c0f6b896aa32901dbf36f31eb33e18cba05d254a764cee72b2aba536f390c4ffb7244107

    • SSDEEP

      98304:Pu+lqUdMYTF3htapMLtg4QwwQ7FL9z8XBlyKMqrTGEli/azGdqzr1+VV2nvlU:PuCFdpF3htTLYwbz4ZTKqVBdU

    Score
    8/10
    spywarestealerupxdiscoveryevasion

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks