7766b84fd690a8a0d97dfaa821f6d7f00e06227d0e5bc3311ba99338e3eda9ca | Triage

Sharing

General

Target

7766b84fd690a8a0d97dfaa821f6d7f00e06227d0e5bc3311ba99338e3eda9ca
Size

1.4MB
Sample

221125-lchj8afh33
MD5

2566b387db10c44815241f0952889dc9
SHA1

39a3a96a2e533769fd7dc97135201874b4baa896
SHA256

7766b84fd690a8a0d97dfaa821f6d7f00e06227d0e5bc3311ba99338e3eda9ca
SHA512

b46d61dcf0339b03c7f6d9bde580189af0e65e8cadcb23214650d36c9f944b209421e3ba04ea8215cc7ef8e863362eab1baa70bb66dc925288498cdedff60e6a
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  7766b84fd690a8a0d97dfaa821f6d7f00e06227d0e5bc3311ba99338e3eda9ca
- Size
  
  1.4MB
- MD5
  
  2566b387db10c44815241f0952889dc9
- SHA1
  
  39a3a96a2e533769fd7dc97135201874b4baa896
- SHA256
  
  7766b84fd690a8a0d97dfaa821f6d7f00e06227d0e5bc3311ba99338e3eda9ca
- SHA512
  
  b46d61dcf0339b03c7f6d9bde580189af0e65e8cadcb23214650d36c9f944b209421e3ba04ea8215cc7ef8e863362eab1baa70bb66dc925288498cdedff60e6a
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer