Overview

overview

8

Static

static

cee8faaf85...8e.exe

windows7-x64

8

cee8faaf85...8e.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e

  • Size

    4.3MB

  • Sample

    221124-xn9zdsch88

  • MD5

    1058e7221af7a5ead913a633e7359d01

  • SHA1

    6592ad9d1f4131391558a472a01b32c812b6a640

  • SHA256

    cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e

  • SHA512

    b37734489b6fa9ce820b667ef4973fdec24f3f93ef1ff16843f5fc3422c870863d28fdf8fc095aea0acddd8951c570636f89cb2c725368fe0b475518c2f009b9

  • SSDEEP

    49152:wrbSCcbNWMdfBcm9fEC7VAE4N3XnSOu4vO6yiMPn+7d8cYxpA:ZWMvdMNHnS74v1nMPn+7

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e

    • Size

      4.3MB

    • MD5

      1058e7221af7a5ead913a633e7359d01

    • SHA1

      6592ad9d1f4131391558a472a01b32c812b6a640

    • SHA256

      cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e

    • SHA512

      b37734489b6fa9ce820b667ef4973fdec24f3f93ef1ff16843f5fc3422c870863d28fdf8fc095aea0acddd8951c570636f89cb2c725368fe0b475518c2f009b9

    • SSDEEP

      49152:wrbSCcbNWMdfBcm9fEC7VAE4N3XnSOu4vO6yiMPn+7d8cYxpA:ZWMvdMNHnS74v1nMPn+7

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks