Overview

overview

8

Static

static

1f9e7de029...35.exe

windows7-x64

8

1f9e7de029...35.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235

  • Size

    2.7MB

  • Sample

    221125-em3jtadg5v

  • MD5

    75978bda1f9d57c316358ed7f87e6172

  • SHA1

    2f3386e5ff8282aa2e27e88d3c0de37770059195

  • SHA256

    1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235

  • SHA512

    82504407a77222382de918a58ad59cd5c60ef85b2819f9adf552384dc761e959b53dbee271bfa9212bde3fe7ad0d114422588f9b656349ace047a13f73add812

  • SSDEEP

    49152:6zfLl4rZeNXUVv9PnbhQFWBHxtRYrM7dbsCXTh:C4rZPveyTarM7dD

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235

    • Size

      2.7MB

    • MD5

      75978bda1f9d57c316358ed7f87e6172

    • SHA1

      2f3386e5ff8282aa2e27e88d3c0de37770059195

    • SHA256

      1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235

    • SHA512

      82504407a77222382de918a58ad59cd5c60ef85b2819f9adf552384dc761e959b53dbee271bfa9212bde3fe7ad0d114422588f9b656349ace047a13f73add812

    • SSDEEP

      49152:6zfLl4rZeNXUVv9PnbhQFWBHxtRYrM7dbsCXTh:C4rZPveyTarM7dD

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks