73e3808a65aa8820099144e05cdb94012c7c909227a01bfff36bea0321d9dc7c | Triage

Sharing

General

Target

73e3808a65aa8820099144e05cdb94012c7c909227a01bfff36bea0321d9dc7c
Size

1.1MB
Sample

221125-kpwryaed74
MD5

839f58325e233294f39cd8a96d28dc80
SHA1

39a28db538a38e8e2ab74e9fd8ea146b3c1ec69b
SHA256

73e3808a65aa8820099144e05cdb94012c7c909227a01bfff36bea0321d9dc7c
SHA512

75de04069eabe3faef1c768c5464b59516846f31aff7d60e64eecc2c8181935f6c031bb8a97f8accde4552a2c8223758eb957c3e1933baa768b10edfeee0230e
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  73e3808a65aa8820099144e05cdb94012c7c909227a01bfff36bea0321d9dc7c
- Size
  
  1.1MB
- MD5
  
  839f58325e233294f39cd8a96d28dc80
- SHA1
  
  39a28db538a38e8e2ab74e9fd8ea146b3c1ec69b
- SHA256
  
  73e3808a65aa8820099144e05cdb94012c7c909227a01bfff36bea0321d9dc7c
- SHA512
  
  75de04069eabe3faef1c768c5464b59516846f31aff7d60e64eecc2c8181935f6c031bb8a97f8accde4552a2c8223758eb957c3e1933baa768b10edfeee0230e
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer