Overview

overview

10

Static

static

b33ef8e6a8...08.exe

windows7-x64

10

b33ef8e6a8...08.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b33ef8e6a8e28936d3c559b02ec134b5ba80921a710c08822673c136f1e9ad08

  • Size

    38KB

  • Sample

    221124-avh3xsaf3v

  • MD5

    1cf01af656a0099f3d5e36b9da750911

  • SHA1

    4f44c5066610b6fd23960a165de2d93cc9b6edbc

  • SHA256

    b33ef8e6a8e28936d3c559b02ec134b5ba80921a710c08822673c136f1e9ad08

  • SHA512

    8652d13686027b9667dd823d7f0469e719a63c1827f9fd932d384f48239838826ceeaf866f4644577f088ad1d48f3bfc4380c2e184fe3fbc76481d855a341957

  • SSDEEP

    384:RmpUto8E6qhIA8ZfiSM+3/marB4djzuf4uFfTlCTZ94GgR01eEe/tfF1XfvgmraJ:cpUt1E/8mS+amkLFRccny45nHguUL

Score
10/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      b33ef8e6a8e28936d3c559b02ec134b5ba80921a710c08822673c136f1e9ad08

    • Size

      38KB

    • MD5

      1cf01af656a0099f3d5e36b9da750911

    • SHA1

      4f44c5066610b6fd23960a165de2d93cc9b6edbc

    • SHA256

      b33ef8e6a8e28936d3c559b02ec134b5ba80921a710c08822673c136f1e9ad08

    • SHA512

      8652d13686027b9667dd823d7f0469e719a63c1827f9fd932d384f48239838826ceeaf866f4644577f088ad1d48f3bfc4380c2e184fe3fbc76481d855a341957

    • SSDEEP

      384:RmpUto8E6qhIA8ZfiSM+3/marB4djzuf4uFfTlCTZ94GgR01eEe/tfF1XfvgmraJ:cpUt1E/8mS+amkLFRccny45nHguUL

    Score
    10/10
    evasionpersistencespywarestealer

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks