Overview

overview

10

Static

static

e83dad3415...d3.exe

windows7-x64

8

e83dad3415...d3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e83dad3415ee3ca0b095f78619f6cd578ae86c7672e6a0c28270bbd6cfcdc3d3

  • Size

    730KB

  • Sample

    221126-w3abmshc4z

  • MD5

    28d8cdbaef107da7a4670c80a9dc91d9

  • SHA1

    ece9bf576f8f458850b8ad48db034690e4ab529e

  • SHA256

    e83dad3415ee3ca0b095f78619f6cd578ae86c7672e6a0c28270bbd6cfcdc3d3

  • SHA512

    208d1a51d216d81b01b2ccd9323a7c1066aae2e1b511fc915ce82e5b3973656e1fb445e1ed5fffccc4cbc546214da7aeb77b0fe15f993608b63cf59c99413106

  • SSDEEP

    12288:cRWNcr8oxncLH0BYXEZyXNbUQI6YrZdzL0wArkRhA6cfUGpXWO4GQQcWcCK7MY2n:3NBIcrctodbUl1larAhA9UsWtGs9Mlnn

Score
10/10
collectionspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    tazbox782

Targets

    • Target

      e83dad3415ee3ca0b095f78619f6cd578ae86c7672e6a0c28270bbd6cfcdc3d3

    • Size

      730KB

    • MD5

      28d8cdbaef107da7a4670c80a9dc91d9

    • SHA1

      ece9bf576f8f458850b8ad48db034690e4ab529e

    • SHA256

      e83dad3415ee3ca0b095f78619f6cd578ae86c7672e6a0c28270bbd6cfcdc3d3

    • SHA512

      208d1a51d216d81b01b2ccd9323a7c1066aae2e1b511fc915ce82e5b3973656e1fb445e1ed5fffccc4cbc546214da7aeb77b0fe15f993608b63cf59c99413106

    • SSDEEP

      12288:cRWNcr8oxncLH0BYXEZyXNbUQI6YrZdzL0wArkRhA6cfUGpXWO4GQQcWcCK7MY2n:3NBIcrctodbUl1larAhA9UsWtGs9Mlnn

    Score
    10/10
    collectionspywarestealer

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks