4c174864a7ef043f7c326b8a5f51cf87bd110373aa79808867bc9d1e51b0346f | Triage

Sharing

General

Target

4c174864a7ef043f7c326b8a5f51cf87bd110373aa79808867bc9d1e51b0346f
Size

931KB
Sample

221125-b9sfksdb36
MD5

3c952e2ed5e639ade111268a2dc0ed89
SHA1

9a47066551fa9e06f0d214cb370faeaefc93e942
SHA256

4c174864a7ef043f7c326b8a5f51cf87bd110373aa79808867bc9d1e51b0346f
SHA512

301f24cd3a2e2451b810698155010f08d8530d4364840333b5d9bdf4f48fb9d3ef982f52f0bbbe00e064e13989e432c35ce95976ddaea98be9f160c6f7b91a41
SSDEEP

24576:h1OYdaOpCZ/iWCvu/2sWsJA/jlt+DHhs9:h1OsXCpYO/dJJDHhs9

Score

8^/10

discovery spyware stealer

Malware Config

Targets

- Target
  
  4c174864a7ef043f7c326b8a5f51cf87bd110373aa79808867bc9d1e51b0346f
- Size
  
  931KB
- MD5
  
  3c952e2ed5e639ade111268a2dc0ed89
- SHA1
  
  9a47066551fa9e06f0d214cb370faeaefc93e942
- SHA256
  
  4c174864a7ef043f7c326b8a5f51cf87bd110373aa79808867bc9d1e51b0346f
- SHA512
  
  301f24cd3a2e2451b810698155010f08d8530d4364840333b5d9bdf4f48fb9d3ef982f52f0bbbe00e064e13989e432c35ce95976ddaea98be9f160c6f7b91a41
- SSDEEP
  
  24576:h1OYdaOpCZ/iWCvu/2sWsJA/jlt+DHhs9:h1OsXCpYO/dJJDHhs9
Score

8^/10

discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer