Overview

overview

8

Static

static

e3ded11062...71.exe

windows7-x64

8

e3ded11062...71.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e3ded1106245b6fba78505755c0e4d5ff6a5ab6937fbb8bfa9c3dec93db5c471

  • Size

    4.2MB

  • Sample

    221124-we7l8sad89

  • MD5

    884b5415ce92cc79f1e1a7a7d4927e56

  • SHA1

    4ad61004c594cba0a83908b8b8d1413b5a7985f7

  • SHA256

    e3ded1106245b6fba78505755c0e4d5ff6a5ab6937fbb8bfa9c3dec93db5c471

  • SHA512

    0500fa340b778c618ad020689c69ac0e1e31dfe22e613462fdde793ab21c8d3abceab9b20d82ca7052b782c56a7191554185d5b48c84bcc9417a935c327a8bd1

  • SSDEEP

    98304:41BdYNkfC0ESHaxxfyjIILYJ372F+DlP5Hiyc+sh5Xn6uR3hf:4Va0gxxfyICyc+sh5Xn6uR3h

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      e3ded1106245b6fba78505755c0e4d5ff6a5ab6937fbb8bfa9c3dec93db5c471

    • Size

      4.2MB

    • MD5

      884b5415ce92cc79f1e1a7a7d4927e56

    • SHA1

      4ad61004c594cba0a83908b8b8d1413b5a7985f7

    • SHA256

      e3ded1106245b6fba78505755c0e4d5ff6a5ab6937fbb8bfa9c3dec93db5c471

    • SHA512

      0500fa340b778c618ad020689c69ac0e1e31dfe22e613462fdde793ab21c8d3abceab9b20d82ca7052b782c56a7191554185d5b48c84bcc9417a935c327a8bd1

    • SSDEEP

      98304:41BdYNkfC0ESHaxxfyjIILYJ372F+DlP5Hiyc+sh5Xn6uR3hf:4Va0gxxfyICyc+sh5Xn6uR3h

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks