Overview

overview

8

Static

static

fa0986bc27...23.exe

windows7-x64

8

fa0986bc27...23.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa0986bc27af9d8eb958a362fdf27da72db72a1aa9c7d0eddfad87f0fa638323

  • Size

    4.3MB

  • Sample

    221124-t5y2nsah51

  • MD5

    90f9a62f092443a0930cde30e65d83bb

  • SHA1

    d6d31136cb4d984bbc55af7e5d04493e6f6e0f21

  • SHA256

    fa0986bc27af9d8eb958a362fdf27da72db72a1aa9c7d0eddfad87f0fa638323

  • SHA512

    e89db9e90042e7800d7e5ecf885f95c3379cd012d3b9eaf4468ff360911bf2b60907e1adad0850499a9da1139b8fde3118bd0dc32092ebc22ef776258441e3ef

  • SSDEEP

    49152:7SuK4jZ0WHCpNqLmxup4GdGKvghxfki1I9buOBqFAZ8hpTQd5r:22Z0NvqgKcGbuOBqFAZspsd5

Score
8/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      fa0986bc27af9d8eb958a362fdf27da72db72a1aa9c7d0eddfad87f0fa638323

    • Size

      4.3MB

    • MD5

      90f9a62f092443a0930cde30e65d83bb

    • SHA1

      d6d31136cb4d984bbc55af7e5d04493e6f6e0f21

    • SHA256

      fa0986bc27af9d8eb958a362fdf27da72db72a1aa9c7d0eddfad87f0fa638323

    • SHA512

      e89db9e90042e7800d7e5ecf885f95c3379cd012d3b9eaf4468ff360911bf2b60907e1adad0850499a9da1139b8fde3118bd0dc32092ebc22ef776258441e3ef

    • SSDEEP

      49152:7SuK4jZ0WHCpNqLmxup4GdGKvghxfki1I9buOBqFAZ8hpTQd5r:22Z0NvqgKcGbuOBqFAZspsd5

    Score
    8/10
    adwarediscoverypersistencestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks