Overview

overview

8

Static

static

040914d251...fb.exe

windows7-x64

8

040914d251...fb.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    040914d251480880fed4896a2a55b662f117f624f7ed872b4d7efa3b42b8bafb

  • Size

    3.5MB

  • Sample

    221124-mbvntsba6z

  • MD5

    ac9b47c26c5bfd77388eaec1d5a7e5fc

  • SHA1

    e78535263873b7ef9a3342397a68a6f2399688e2

  • SHA256

    040914d251480880fed4896a2a55b662f117f624f7ed872b4d7efa3b42b8bafb

  • SHA512

    5b0bbcc0adaeb0aa9aa91152a3afe71c5b3acde47ebb21fb1fc06dcdf1492912862e2e7a1ccc82fd79426342c980e5c710e95374ed2149e6968fffdfb9da4800

  • SSDEEP

    49152:eC2fM9u+h7lCuTS/7gPxSGjH/v7usZ+hgS2BZgkqxRZOvJnZ16T6e:eC2U9zllYMPP37K7kcxXORnD

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      040914d251480880fed4896a2a55b662f117f624f7ed872b4d7efa3b42b8bafb

    • Size

      3.5MB

    • MD5

      ac9b47c26c5bfd77388eaec1d5a7e5fc

    • SHA1

      e78535263873b7ef9a3342397a68a6f2399688e2

    • SHA256

      040914d251480880fed4896a2a55b662f117f624f7ed872b4d7efa3b42b8bafb

    • SHA512

      5b0bbcc0adaeb0aa9aa91152a3afe71c5b3acde47ebb21fb1fc06dcdf1492912862e2e7a1ccc82fd79426342c980e5c710e95374ed2149e6968fffdfb9da4800

    • SSDEEP

      49152:eC2fM9u+h7lCuTS/7gPxSGjH/v7usZ+hgS2BZgkqxRZOvJnZ16T6e:eC2U9zllYMPP37K7kcxXORnD

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks