1d82c8b13bb72be2559a4964300349a5e78b4920d190a1e2bbfb5ea4404a0e3e | Triage

Sharing

General

Target

1d82c8b13bb72be2559a4964300349a5e78b4920d190a1e2bbfb5ea4404a0e3e
Size

2.8MB
Sample

221125-kprg8ahh4x
MD5

f45c3bd2de591e0ae079ac04f57abdaf
SHA1

da118768ae0195bfd307df8e31ac647bc275cba9
SHA256

1d82c8b13bb72be2559a4964300349a5e78b4920d190a1e2bbfb5ea4404a0e3e
SHA512

a589b2980cf541dfd877958f2383e04c8731d390060b47572ea7ea35bc02b000121bfb38b62fabc906fd8a710a6c2dca5f5877fb0eaae2751f276486ae08db86
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  1d82c8b13bb72be2559a4964300349a5e78b4920d190a1e2bbfb5ea4404a0e3e
- Size
  
  2.8MB
- MD5
  
  f45c3bd2de591e0ae079ac04f57abdaf
- SHA1
  
  da118768ae0195bfd307df8e31ac647bc275cba9
- SHA256
  
  1d82c8b13bb72be2559a4964300349a5e78b4920d190a1e2bbfb5ea4404a0e3e
- SHA512
  
  a589b2980cf541dfd877958f2383e04c8731d390060b47572ea7ea35bc02b000121bfb38b62fabc906fd8a710a6c2dca5f5877fb0eaae2751f276486ae08db86
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer