Overview

overview

10

Static

static

5460d559b8...8e.exe

windows7-x64

5460d559b8...8e.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5460d559b800cf81b6e2406d2e30b27c11471d69e234ed1d64d5d0926fb9228e

  • Size

    1.0MB

  • Sample

    221125-k1xhlsfb44

  • MD5

    a63d517c0e122e367e484cf75edbf34f

  • SHA1

    f8538f5d687c5e36f05da55ea56c2ab8fb355b63

  • SHA256

    5460d559b800cf81b6e2406d2e30b27c11471d69e234ed1d64d5d0926fb9228e

  • SHA512

    c7a40453d2053be2b043e0e3359e13f3cbfd6bb357e72d853af040add9f1aaf33f6e7158b82fe8bd926cc94f1736a2be67ba48adae79b12ddc5972f9d634df69

  • SSDEEP

    3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      5460d559b800cf81b6e2406d2e30b27c11471d69e234ed1d64d5d0926fb9228e

    • Size

      1.0MB

    • MD5

      a63d517c0e122e367e484cf75edbf34f

    • SHA1

      f8538f5d687c5e36f05da55ea56c2ab8fb355b63

    • SHA256

      5460d559b800cf81b6e2406d2e30b27c11471d69e234ed1d64d5d0926fb9228e

    • SHA512

      c7a40453d2053be2b043e0e3359e13f3cbfd6bb357e72d853af040add9f1aaf33f6e7158b82fe8bd926cc94f1736a2be67ba48adae79b12ddc5972f9d634df69

    • SSDEEP

      3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

    Score
    10/10
    persistencespywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks