2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb | Triage

Sharing

General

Target

2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb
Size

2.0MB
Sample

221125-dymgasgh35
MD5

db50908c54a6e2a38262c9e34f92aeff
SHA1

d0121b3055c644aaa52bab0d361f55c6f940a735
SHA256

2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb
SHA512

30960dbc9d33369ae1d25a431e2374e29bed275fed5c5c8b31452000cb7ae09cb8755cfa906d683b86b92def86dbbdf52a32bee5b7d34f7e516a8961cb81f598
SSDEEP

49152:PWkg+8k0yn5E28REVPVxSCy2zRPOHQ/UZ8YROO19dJLkWoubXX2:PK+6M5R1V9K2BOHQ/i8m193oWoKXX2

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb
- Size
  
  2.0MB
- MD5
  
  db50908c54a6e2a38262c9e34f92aeff
- SHA1
  
  d0121b3055c644aaa52bab0d361f55c6f940a735
- SHA256
  
  2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb
- SHA512
  
  30960dbc9d33369ae1d25a431e2374e29bed275fed5c5c8b31452000cb7ae09cb8755cfa906d683b86b92def86dbbdf52a32bee5b7d34f7e516a8961cb81f598
- SSDEEP
  
  49152:PWkg+8k0yn5E28REVPVxSCy2zRPOHQ/UZ8YROO19dJLkWoubXX2:PK+6M5R1V9K2BOHQ/i8m193oWoKXX2
Score

8^/10

adware discovery persistence spyware stealer
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoverypersistencespywarestealer

behavioral2

adwarediscoverypersistencespywarestealer