0ace968ae7c85f6c1c0dcefc46d59e9625625a2f6b316de0e35fb5bfa00012a8 | Triage

Sharing

General

Target

0ace968ae7c85f6c1c0dcefc46d59e9625625a2f6b316de0e35fb5bfa00012a8
Size

515KB
Sample

221125-kxajnsac6z
MD5

52b63db08080ad73be76914a7b93d795
SHA1

534e983d73ecec65ff8b8e4ef7337292b7070a9a
SHA256

0ace968ae7c85f6c1c0dcefc46d59e9625625a2f6b316de0e35fb5bfa00012a8
SHA512

1df366278c8a12c1b4b9b9d00f2849771966f2972cbfba86b0c99a0cc6e73a9dd4332ca9eea536c56545fc42d3d0ee022e22c06beb4a22619635b99e8e49b0c8
SSDEEP

3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  0ace968ae7c85f6c1c0dcefc46d59e9625625a2f6b316de0e35fb5bfa00012a8
- Size
  
  515KB
- MD5
  
  52b63db08080ad73be76914a7b93d795
- SHA1
  
  534e983d73ecec65ff8b8e4ef7337292b7070a9a
- SHA256
  
  0ace968ae7c85f6c1c0dcefc46d59e9625625a2f6b316de0e35fb5bfa00012a8
- SHA512
  
  1df366278c8a12c1b4b9b9d00f2849771966f2972cbfba86b0c99a0cc6e73a9dd4332ca9eea536c56545fc42d3d0ee022e22c06beb4a22619635b99e8e49b0c8
- SSDEEP
  
  3072:dSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbMtJyVdyw:ssqhJMxzJiU5SeLmNSbMtJU5
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer