Overview

overview

8

Static

static

1d4cd66e02...d0.exe

windows7-x64

8

1d4cd66e02...d0.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d4cd66e02af223094ce705d9f40e5da4e74bf3cb9098667c0fe5def28b6efd0

  • Size

    4.2MB

  • Sample

    221124-j9t86sea9t

  • MD5

    6371da6e6d91434bb5b6b6d79625bb55

  • SHA1

    531e4b220678dd9dda65d072c5b71d4d4bc44db5

  • SHA256

    1d4cd66e02af223094ce705d9f40e5da4e74bf3cb9098667c0fe5def28b6efd0

  • SHA512

    293f48c8ae76ae93b2d15ca42b13d425bca5dd0faad8e0376c168a5dcee3f0a24625b9530c7f14f8bdadd42cb9f6476dd8523709c1aafe6d20506c8b9971f826

  • SSDEEP

    98304:WIyGqt6UT0kSHaRxfyDIIbYJ372FeXKqyG+kevFrmKg:WOA0ARxfykkFZ

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      1d4cd66e02af223094ce705d9f40e5da4e74bf3cb9098667c0fe5def28b6efd0

    • Size

      4.2MB

    • MD5

      6371da6e6d91434bb5b6b6d79625bb55

    • SHA1

      531e4b220678dd9dda65d072c5b71d4d4bc44db5

    • SHA256

      1d4cd66e02af223094ce705d9f40e5da4e74bf3cb9098667c0fe5def28b6efd0

    • SHA512

      293f48c8ae76ae93b2d15ca42b13d425bca5dd0faad8e0376c168a5dcee3f0a24625b9530c7f14f8bdadd42cb9f6476dd8523709c1aafe6d20506c8b9971f826

    • SSDEEP

      98304:WIyGqt6UT0kSHaRxfyDIIbYJ372FeXKqyG+kevFrmKg:WOA0ARxfykkFZ

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks