Overview

overview

10

Static

static

7fb73d0b2a...29.exe

windows7-x64

7fb73d0b2a...29.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7fb73d0b2a2e046bbfd758d61d21021e1224e00e67e20283ab9d1485f8772f29

  • Size

    1.3MB

  • Sample

    221125-lfxhjsgb26

  • MD5

    853888867984a10d241447ffb5b8c27d

  • SHA1

    46638014aba3ae55304fcb29c098500dd8285d51

  • SHA256

    7fb73d0b2a2e046bbfd758d61d21021e1224e00e67e20283ab9d1485f8772f29

  • SHA512

    241dc49283514f3980a916a90d80c07d0a3412587164b34aef1c342f54c57627ef0b979c9b73b7e19bc8c97d57c3d9bce6450ab750f1f206d206cad86a4d990d

  • SSDEEP

    3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      7fb73d0b2a2e046bbfd758d61d21021e1224e00e67e20283ab9d1485f8772f29

    • Size

      1.3MB

    • MD5

      853888867984a10d241447ffb5b8c27d

    • SHA1

      46638014aba3ae55304fcb29c098500dd8285d51

    • SHA256

      7fb73d0b2a2e046bbfd758d61d21021e1224e00e67e20283ab9d1485f8772f29

    • SHA512

      241dc49283514f3980a916a90d80c07d0a3412587164b34aef1c342f54c57627ef0b979c9b73b7e19bc8c97d57c3d9bce6450ab750f1f206d206cad86a4d990d

    • SSDEEP

      3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

    Score
    10/10
    persistencespywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks