Overview

overview

8

Static

static

d2449ed72e...63.exe

windows7-x64

8

d2449ed72e...63.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2449ed72e468dfc1af6884012bf969bafeae4c3ee1c2a0bb3dc655081abef63

  • Size

    214KB

  • Sample

    221124-aq9p3sac8y

  • MD5

    289fa91fdafefd29495837ef930b1110

  • SHA1

    172b3d1285db5bf394cd34ad849dd8d2071df556

  • SHA256

    d2449ed72e468dfc1af6884012bf969bafeae4c3ee1c2a0bb3dc655081abef63

  • SHA512

    69c04f40cde4e7b3843205918ee3077223c0fc6ef3e8e8f178940e022d050861ac62fa991b2e334375376fee4e535629845f210d6eff809c32e4e951acc9fe61

  • SSDEEP

    3072:SCSjGoLpWM6YB/XxAyKH//EzEymgtqM0KTjiTz+Tos7gr7M/engK5qn:UXZ/tgym6Usji8f2Y/eB

Score
8/10
persistencespywarestealer

Malware Config

Targets

    • Target

      d2449ed72e468dfc1af6884012bf969bafeae4c3ee1c2a0bb3dc655081abef63

    • Size

      214KB

    • MD5

      289fa91fdafefd29495837ef930b1110

    • SHA1

      172b3d1285db5bf394cd34ad849dd8d2071df556

    • SHA256

      d2449ed72e468dfc1af6884012bf969bafeae4c3ee1c2a0bb3dc655081abef63

    • SHA512

      69c04f40cde4e7b3843205918ee3077223c0fc6ef3e8e8f178940e022d050861ac62fa991b2e334375376fee4e535629845f210d6eff809c32e4e951acc9fe61

    • SSDEEP

      3072:SCSjGoLpWM6YB/XxAyKH//EzEymgtqM0KTjiTz+Tos7gr7M/engK5qn:UXZ/tgym6Usji8f2Y/eB

    Score
    8/10
    persistencespywarestealer

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks