b5970ed558461a6f17512c70fb4f2e5c28b40914389e28aa2f0bb67e87f521a4 | Triage

Sharing

General

Target

b5970ed558461a6f17512c70fb4f2e5c28b40914389e28aa2f0bb67e87f521a4
Size

318KB
Sample

221125-k2cjtsfb62
MD5

c38674135a648df803c2253f03dbc454
SHA1

804fe6541d91f493498b9a464faa58d60011b434
SHA256

b5970ed558461a6f17512c70fb4f2e5c28b40914389e28aa2f0bb67e87f521a4
SHA512

e44db875a786d239454f099500645fdd1cac22f6ed3333594148843b4d84f7cc87bba5c82b6ab10dd29e9fb513f0c5bcbfe322528358ec0b76e88b53a1a0f265
SSDEEP

3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  b5970ed558461a6f17512c70fb4f2e5c28b40914389e28aa2f0bb67e87f521a4
- Size
  
  318KB
- MD5
  
  c38674135a648df803c2253f03dbc454
- SHA1
  
  804fe6541d91f493498b9a464faa58d60011b434
- SHA256
  
  b5970ed558461a6f17512c70fb4f2e5c28b40914389e28aa2f0bb67e87f521a4
- SHA512
  
  e44db875a786d239454f099500645fdd1cac22f6ed3333594148843b4d84f7cc87bba5c82b6ab10dd29e9fb513f0c5bcbfe322528358ec0b76e88b53a1a0f265
- SSDEEP
  
  3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer