Overview

overview

8

Static

static

4adc224a72...af.exe

windows7-x64

8

4adc224a72...af.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4adc224a72a7b44a5c66aae2620047971ea10e28a5105f4b89907f50386e53af

  • Size

    3.8MB

  • Sample

    221125-js6wmsfg8v

  • MD5

    f360078d68d9eb709834b22a966ea853

  • SHA1

    9fe703cfe186f6c9484a789bc5a12c8e3f956695

  • SHA256

    4adc224a72a7b44a5c66aae2620047971ea10e28a5105f4b89907f50386e53af

  • SHA512

    750856428307faa0c13a452724159dbb8578f2112f7e9f6616870e4b3c383db14e5950378e558e07eee605089e7637de041b3cbdf08bc3bbcb312c83d712e71f

  • SSDEEP

    49152:5TPrJM4KMnQJT3QK9q3krGbJeJWPP8Qi8Xgcx1licbcpaQAtIdvxleWuNzEpM1W:9d9nOcVdbJ/ET8lDlicbcpaBtYlZu

Score
8/10
adwarediscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      4adc224a72a7b44a5c66aae2620047971ea10e28a5105f4b89907f50386e53af

    • Size

      3.8MB

    • MD5

      f360078d68d9eb709834b22a966ea853

    • SHA1

      9fe703cfe186f6c9484a789bc5a12c8e3f956695

    • SHA256

      4adc224a72a7b44a5c66aae2620047971ea10e28a5105f4b89907f50386e53af

    • SHA512

      750856428307faa0c13a452724159dbb8578f2112f7e9f6616870e4b3c383db14e5950378e558e07eee605089e7637de041b3cbdf08bc3bbcb312c83d712e71f

    • SSDEEP

      49152:5TPrJM4KMnQJT3QK9q3krGbJeJWPP8Qi8Xgcx1licbcpaQAtIdvxleWuNzEpM1W:9d9nOcVdbJ/ET8lDlicbcpaBtYlZu

    Score
    8/10
    adwarediscoverypersistencespywarestealer

    • Registers COM server for autorun

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops Chrome extension

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks