Overview

overview

10

Static

static

82bf7ca11b...82.exe

windows7-x64

82bf7ca11b...82.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    82bf7ca11bce0cee91de2203901f11a5510532ce79e4584550a72bee0eca8282

  • Size

    696KB

  • Sample

    221125-lm1hsage43

  • MD5

    74ff689cb6c92f1ef8dab70a306d9caa

  • SHA1

    4b35aa7cbc3abf4b17fca14d32729cbb93616a40

  • SHA256

    82bf7ca11bce0cee91de2203901f11a5510532ce79e4584550a72bee0eca8282

  • SHA512

    5971faee3b6d67fac9a0810adc31bd6210a4d074d02d026a8c5a9979fc6b80b49a41bbc9681e8d3a25201f6a9a55c19d95fcc546012f64a3ce1a136a67e75584

  • SSDEEP

    3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      82bf7ca11bce0cee91de2203901f11a5510532ce79e4584550a72bee0eca8282

    • Size

      696KB

    • MD5

      74ff689cb6c92f1ef8dab70a306d9caa

    • SHA1

      4b35aa7cbc3abf4b17fca14d32729cbb93616a40

    • SHA256

      82bf7ca11bce0cee91de2203901f11a5510532ce79e4584550a72bee0eca8282

    • SHA512

      5971faee3b6d67fac9a0810adc31bd6210a4d074d02d026a8c5a9979fc6b80b49a41bbc9681e8d3a25201f6a9a55c19d95fcc546012f64a3ce1a136a67e75584

    • SSDEEP

      3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

    Score
    10/10
    persistencespywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks