58ccb815d2b8bbe042fccf774df51326bb2abcabeb200030b9f8a76fc2c356f7 | Triage

Sharing

General

Target

58ccb815d2b8bbe042fccf774df51326bb2abcabeb200030b9f8a76fc2c356f7
Size

879KB
Sample

221125-kvn92seg58
MD5

d175a6c575495a3bb75f1bfa25285a04
SHA1

c51bea21066224f55dcce7d5b3e1c54039edf701
SHA256

58ccb815d2b8bbe042fccf774df51326bb2abcabeb200030b9f8a76fc2c356f7
SHA512

e3018d4fc7f2179025691955f10dc2f110d94079664321722bfa7e6eae8aa48a5e22576ae88f0912a72948f6bd45a61bbbaa38020c3ad110802ebc90d8ec29cb
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  58ccb815d2b8bbe042fccf774df51326bb2abcabeb200030b9f8a76fc2c356f7
- Size
  
  879KB
- MD5
  
  d175a6c575495a3bb75f1bfa25285a04
- SHA1
  
  c51bea21066224f55dcce7d5b3e1c54039edf701
- SHA256
  
  58ccb815d2b8bbe042fccf774df51326bb2abcabeb200030b9f8a76fc2c356f7
- SHA512
  
  e3018d4fc7f2179025691955f10dc2f110d94079664321722bfa7e6eae8aa48a5e22576ae88f0912a72948f6bd45a61bbbaa38020c3ad110802ebc90d8ec29cb
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer