Overview

overview

10

Static

static

c0ab076bd7...67.exe

windows7-x64

c0ab076bd7...67.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c0ab076bd790e520cbbfc543bc24c486577021b6cce0f35cf7e9a11a11f46a67

  • Size

    1.1MB

  • Sample

    221125-kyy9esfa35

  • MD5

    e8d0d6c10ba86c6a7f3416f892f3bf0e

  • SHA1

    72a90ff66cd7d691e4ac15e203ef5328b1b8cedc

  • SHA256

    c0ab076bd790e520cbbfc543bc24c486577021b6cce0f35cf7e9a11a11f46a67

  • SHA512

    6e4918a63c7ada10bba603e1964f4a666cae269cd221cf631430a0139327914da31e37c26603eb8bc8654a68da38e79486b6aeb2864836a142f215e8d7b39629

  • SSDEEP

    3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      c0ab076bd790e520cbbfc543bc24c486577021b6cce0f35cf7e9a11a11f46a67

    • Size

      1.1MB

    • MD5

      e8d0d6c10ba86c6a7f3416f892f3bf0e

    • SHA1

      72a90ff66cd7d691e4ac15e203ef5328b1b8cedc

    • SHA256

      c0ab076bd790e520cbbfc543bc24c486577021b6cce0f35cf7e9a11a11f46a67

    • SHA512

      6e4918a63c7ada10bba603e1964f4a666cae269cd221cf631430a0139327914da31e37c26603eb8bc8654a68da38e79486b6aeb2864836a142f215e8d7b39629

    • SSDEEP

      3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

    Score
    10/10
    persistencespywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks