e8940602d2bbd3f3ec5447e8bdbbf8cb9bdf3de0ecc0c9a28fc5be530c862bd3 | Triage

Sharing

General

Target

e8940602d2bbd3f3ec5447e8bdbbf8cb9bdf3de0ecc0c9a28fc5be530c862bd3
Size

1.4MB
Sample

221125-lnebyage59
MD5

657490762b3af18de3c6ac4e75544172
SHA1

5ea5b9e41b3f59f486768b19c8347977384933a9
SHA256

e8940602d2bbd3f3ec5447e8bdbbf8cb9bdf3de0ecc0c9a28fc5be530c862bd3
SHA512

a46cd2da83c1433354e85c28d327e00fbe76845d33720dfd2140d80fdbf8ba09d8cf7f3d3d7cd4acc9671fb013ce164fdf9e35efd9b6af1b104f0b4f8f4c3c23
SSDEEP

3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1

Score

10^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  e8940602d2bbd3f3ec5447e8bdbbf8cb9bdf3de0ecc0c9a28fc5be530c862bd3
- Size
  
  1.4MB
- MD5
  
  657490762b3af18de3c6ac4e75544172
- SHA1
  
  5ea5b9e41b3f59f486768b19c8347977384933a9
- SHA256
  
  e8940602d2bbd3f3ec5447e8bdbbf8cb9bdf3de0ecc0c9a28fc5be530c862bd3
- SHA512
  
  a46cd2da83c1433354e85c28d327e00fbe76845d33720dfd2140d80fdbf8ba09d8cf7f3d3d7cd4acc9671fb013ce164fdf9e35efd9b6af1b104f0b4f8f4c3c23
- SSDEEP
  
  3072:aSsvihLlTQz9z71iURo2SJJmY6uFNcgifDbmeTXwVdBR:rsqhJMxzJiU5SeLmNSbmebW1
Score

10^/10

persistence spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer