9e7203ff6ab8e54848e1b4f74186eb30d21c7cbe1f088d3162960b3534b0f716 | Triage

Sharing

General

Target

9e7203ff6ab8e54848e1b4f74186eb30d21c7cbe1f088d3162960b3534b0f716
Size

409KB
Sample

221123-xshqpsfh45
MD5

1ca96568c17ee7dc97a85177213429ed
SHA1

7f4f5ca475f1540eae726b7a21897f72c1fbe598
SHA256

9e7203ff6ab8e54848e1b4f74186eb30d21c7cbe1f088d3162960b3534b0f716
SHA512

98a98130c5514acf9c2581184d4b236e5427c06fb2a328636c94973ab6c560b34c9616e3937731d5197d42cc05e105452ecbdc3e009b41298d5224842a767168
SSDEEP

6144:6BCb5KHuGsOLWyGhsVODNo8IlQXmhG45g7gCc7K/m5VnBsBQDagtvyVVcoSnJAWg:QC1KO1hsVyNNIl4T6keB2guHOAWaLE

Score

8^/10

discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  9e7203ff6ab8e54848e1b4f74186eb30d21c7cbe1f088d3162960b3534b0f716
- Size
  
  409KB
- MD5
  
  1ca96568c17ee7dc97a85177213429ed
- SHA1
  
  7f4f5ca475f1540eae726b7a21897f72c1fbe598
- SHA256
  
  9e7203ff6ab8e54848e1b4f74186eb30d21c7cbe1f088d3162960b3534b0f716
- SHA512
  
  98a98130c5514acf9c2581184d4b236e5427c06fb2a328636c94973ab6c560b34c9616e3937731d5197d42cc05e105452ecbdc3e009b41298d5224842a767168
- SSDEEP
  
  6144:6BCb5KHuGsOLWyGhsVODNo8IlQXmhG45g7gCc7K/m5VnBsBQDagtvyVVcoSnJAWg:QC1KO1hsVyNNIl4T6keB2guHOAWaLE
Score

8^/10

discovery evasion spyware stealer trojan
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionspywarestealertrojan

behavioral2