731b6ea46ede14cd88aff2fe82b29a0311d6acb7de673b75ddae3fd46030ff44 | Triage

Sharing

General

Target

731b6ea46ede14cd88aff2fe82b29a0311d6acb7de673b75ddae3fd46030ff44
Size

996KB
Sample

221125-khw45ahe2v
MD5

0fe043133cc55ef3cf6f64c319eb3fff
SHA1

2ba8f8d90cc60d325d87adfd806c2cddd8f1ffdc
SHA256

731b6ea46ede14cd88aff2fe82b29a0311d6acb7de673b75ddae3fd46030ff44
SHA512

4425b0cc631d3d5fe297df7029e92d5ef4ff8a47356506a08387e7d353918cd470fef399ad718329ddd99f159527cc0ebbf263d8028926bca91f742f0ea00f61
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  731b6ea46ede14cd88aff2fe82b29a0311d6acb7de673b75ddae3fd46030ff44
- Size
  
  996KB
- MD5
  
  0fe043133cc55ef3cf6f64c319eb3fff
- SHA1
  
  2ba8f8d90cc60d325d87adfd806c2cddd8f1ffdc
- SHA256
  
  731b6ea46ede14cd88aff2fe82b29a0311d6acb7de673b75ddae3fd46030ff44
- SHA512
  
  4425b0cc631d3d5fe297df7029e92d5ef4ff8a47356506a08387e7d353918cd470fef399ad718329ddd99f159527cc0ebbf263d8028926bca91f742f0ea00f61
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2