b1c587c109c75a5e0bc4470c3556227d165f53a60b0154c82312cdf86a4d1d05 | Triage

Sharing

General

Target

b1c587c109c75a5e0bc4470c3556227d165f53a60b0154c82312cdf86a4d1d05
Size

553KB
Sample

221125-ldmwbsfh84
MD5

46ed318d666e106e5a3ace604abf830d
SHA1

e79ed4864252f63866a1158b47ea2d4917963a37
SHA256

b1c587c109c75a5e0bc4470c3556227d165f53a60b0154c82312cdf86a4d1d05
SHA512

97378a3367e6e415672d68872c59b92dcf9a3007e1a3e2793a039bcd38f022b895b06bc026dc76b4191c426f0afccb9a5a256e563446850f5c16de3e5803f6f3
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  b1c587c109c75a5e0bc4470c3556227d165f53a60b0154c82312cdf86a4d1d05
- Size
  
  553KB
- MD5
  
  46ed318d666e106e5a3ace604abf830d
- SHA1
  
  e79ed4864252f63866a1158b47ea2d4917963a37
- SHA256
  
  b1c587c109c75a5e0bc4470c3556227d165f53a60b0154c82312cdf86a4d1d05
- SHA512
  
  97378a3367e6e415672d68872c59b92dcf9a3007e1a3e2793a039bcd38f022b895b06bc026dc76b4191c426f0afccb9a5a256e563446850f5c16de3e5803f6f3
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer