30e349c4207dc03f8c2cdbeaa4532c07e91a1b3aa107a44c7e7e13974eed3527 | Triage

Sharing

General

Target

30e349c4207dc03f8c2cdbeaa4532c07e91a1b3aa107a44c7e7e13974eed3527
Size

931KB
Sample

221124-g61knsec28
MD5

2b69b9af78ecbcf2afd186058211af05
SHA1

c9fde7dbe7ca74071f63d67c3a88fabee27aa513
SHA256

30e349c4207dc03f8c2cdbeaa4532c07e91a1b3aa107a44c7e7e13974eed3527
SHA512

b7e39c271a98d02f4b9ec71b7e71b058506aa400392e63ba37ed25ea9548b3a0cfacbc2cb5bbfe9328f6a6fc201d0bb3a17d34474fa0df208daa82f844d6313b
SSDEEP

24576:h1OYdaOgMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpf2:h1Os+MWyUQ+GUVFIcHPvpf2

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  30e349c4207dc03f8c2cdbeaa4532c07e91a1b3aa107a44c7e7e13974eed3527
- Size
  
  931KB
- MD5
  
  2b69b9af78ecbcf2afd186058211af05
- SHA1
  
  c9fde7dbe7ca74071f63d67c3a88fabee27aa513
- SHA256
  
  30e349c4207dc03f8c2cdbeaa4532c07e91a1b3aa107a44c7e7e13974eed3527
- SHA512
  
  b7e39c271a98d02f4b9ec71b7e71b058506aa400392e63ba37ed25ea9548b3a0cfacbc2cb5bbfe9328f6a6fc201d0bb3a17d34474fa0df208daa82f844d6313b
- SSDEEP
  
  24576:h1OYdaOgMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpf2:h1Os+MWyUQ+GUVFIcHPvpf2
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer