d53612557b5266cdc7b68f433ac079f52d2fca618f239a1a788a904eecec3a9f | Triage

Sharing

General

Target

d53612557b5266cdc7b68f433ac079f52d2fca618f239a1a788a904eecec3a9f
Size

2.2MB
Sample

221125-kqd9aaed97
MD5

918e8a42969bf7116f9fee3920f69452
SHA1

36f62373783a63c52f7987cb696c3a00c8ad3ddb
SHA256

d53612557b5266cdc7b68f433ac079f52d2fca618f239a1a788a904eecec3a9f
SHA512

745e2df16ede25dfbba03e6a359b5c48177121643931f5b861701455c34e1e45c00eff80e29fddbf62d60be9b0714158f726ee3a5582442ad342c9b21c540645
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  d53612557b5266cdc7b68f433ac079f52d2fca618f239a1a788a904eecec3a9f
- Size
  
  2.2MB
- MD5
  
  918e8a42969bf7116f9fee3920f69452
- SHA1
  
  36f62373783a63c52f7987cb696c3a00c8ad3ddb
- SHA256
  
  d53612557b5266cdc7b68f433ac079f52d2fca618f239a1a788a904eecec3a9f
- SHA512
  
  745e2df16ede25dfbba03e6a359b5c48177121643931f5b861701455c34e1e45c00eff80e29fddbf62d60be9b0714158f726ee3a5582442ad342c9b21c540645
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer