Overview

overview

8

Static

static

702f426454...26.exe

windows7-x64

8

702f426454...26.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    702f4264548f78283339392ee83f2dc93846239001d37ee0a182dd4083af7826

  • Size

    4.5MB

  • Sample

    221124-31ab7agf52

  • MD5

    a46c20f467aa3ed54ccc546f2adfa3f1

  • SHA1

    034efdd02671bd2778393d2ce91486ab197352e3

  • SHA256

    702f4264548f78283339392ee83f2dc93846239001d37ee0a182dd4083af7826

  • SHA512

    59b6d2493ef0792124815dd385b43f4bbd9c39297516d9de728e4716aefe08a5f6d917f126ebaa17d1e7e8dfb2347e41b84d74ecef5f5ced3f1d5453460a9c16

  • SSDEEP

    49152:E4aKqZJkqNejCknaxup4jQeBdGKvghxfki1H9buOBqFOEjSlM/Zf0weeDNxrh:pOJkPmkg/qKcbbuOBqFOEj8MNtLNxr

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      702f4264548f78283339392ee83f2dc93846239001d37ee0a182dd4083af7826

    • Size

      4.5MB

    • MD5

      a46c20f467aa3ed54ccc546f2adfa3f1

    • SHA1

      034efdd02671bd2778393d2ce91486ab197352e3

    • SHA256

      702f4264548f78283339392ee83f2dc93846239001d37ee0a182dd4083af7826

    • SHA512

      59b6d2493ef0792124815dd385b43f4bbd9c39297516d9de728e4716aefe08a5f6d917f126ebaa17d1e7e8dfb2347e41b84d74ecef5f5ced3f1d5453460a9c16

    • SSDEEP

      49152:E4aKqZJkqNejCknaxup4jQeBdGKvghxfki1H9buOBqFOEjSlM/Zf0weeDNxrh:pOJkPmkg/qKcbbuOBqFOEj8MNtLNxr

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks