Overview

overview

8

Static

static

9513bf7baa...19.exe

windows7-x64

8

9513bf7baa...19.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9513bf7baa2be54d9670522bbba5fd0accf34e0503ee494b29f6128f4753e919

  • Size

    2.7MB

  • Sample

    221124-1yl7vsfc7w

  • MD5

    084aa8bb6812969a1170f64fe5e8e403

  • SHA1

    91c1b50cf65f857e7da2b07c0e402a61e909bcde

  • SHA256

    9513bf7baa2be54d9670522bbba5fd0accf34e0503ee494b29f6128f4753e919

  • SHA512

    f5bd3e908107b0cb76cc938f91b7ca761ed53d7a61bf07ddb09f101b6b4635fe449fc7f0c544179d7983667563747adf56e5ceef4d6b16028d375d754086cb39

  • SSDEEP

    49152:0+9V7KppWmD/M2BKQlic7SKjyoC3yE/Ac5mWxnmw1h:0C7Kpp1D/F7SK2oWNAxenj

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      9513bf7baa2be54d9670522bbba5fd0accf34e0503ee494b29f6128f4753e919

    • Size

      2.7MB

    • MD5

      084aa8bb6812969a1170f64fe5e8e403

    • SHA1

      91c1b50cf65f857e7da2b07c0e402a61e909bcde

    • SHA256

      9513bf7baa2be54d9670522bbba5fd0accf34e0503ee494b29f6128f4753e919

    • SHA512

      f5bd3e908107b0cb76cc938f91b7ca761ed53d7a61bf07ddb09f101b6b4635fe449fc7f0c544179d7983667563747adf56e5ceef4d6b16028d375d754086cb39

    • SSDEEP

      49152:0+9V7KppWmD/M2BKQlic7SKjyoC3yE/Ac5mWxnmw1h:0C7Kpp1D/F7SK2oWNAxenj

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks