ce74fbb84781724fe08b874a531ec8903c6cc3a0931d6cf65e13e31dfb7169f4 | Triage

Sharing

General

Target

ce74fbb84781724fe08b874a531ec8903c6cc3a0931d6cf65e13e31dfb7169f4
Size

930KB
Sample

221124-xp378sgb6w
MD5

d05b1cb49329b7336ac88e2dae3b08fc
SHA1

6fa4255a56ce9d197c21b5568a62792ee650c12d
SHA256

ce74fbb84781724fe08b874a531ec8903c6cc3a0931d6cf65e13e31dfb7169f4
SHA512

a68b50501ad06c33e87cb7874ee1472c01fa6e40bc5bca901d788e2b51212da39b76c2f75dabd88f623dc20b457ee877e1d40c3f25d0d8ac4896ffad9a2f184e
SSDEEP

24576:h1OYdaOMSQebGxfE6SQ8SlJXX7hMtX+m+BXK3H1DLvou3fJNAq2MSH5ENbmyyJ:h1Os6SQeb71DLvFzAqRmyyJ

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  ce74fbb84781724fe08b874a531ec8903c6cc3a0931d6cf65e13e31dfb7169f4
- Size
  
  930KB
- MD5
  
  d05b1cb49329b7336ac88e2dae3b08fc
- SHA1
  
  6fa4255a56ce9d197c21b5568a62792ee650c12d
- SHA256
  
  ce74fbb84781724fe08b874a531ec8903c6cc3a0931d6cf65e13e31dfb7169f4
- SHA512
  
  a68b50501ad06c33e87cb7874ee1472c01fa6e40bc5bca901d788e2b51212da39b76c2f75dabd88f623dc20b457ee877e1d40c3f25d0d8ac4896ffad9a2f184e
- SSDEEP
  
  24576:h1OYdaOMSQebGxfE6SQ8SlJXX7hMtX+m+BXK3H1DLvou3fJNAq2MSH5ENbmyyJ:h1Os6SQeb71DLvFzAqRmyyJ
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer