Overview

overview

9

Static

static

8

7dc19e400d...45.exe

windows7-x64

9

7dc19e400d...45.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7dc19e400d1784dfb646ac55ff012359d1501d06fa968306a7462c414ab2ce45

  • Size

    356KB

  • Sample

    221127-l65lvahc96

  • MD5

    031a25a6e4fcfcc6835f4df2ffba3dc9

  • SHA1

    a28fe5dc28b7839bba8b61a5a3f2e56b531e26c3

  • SHA256

    7dc19e400d1784dfb646ac55ff012359d1501d06fa968306a7462c414ab2ce45

  • SHA512

    2efbd650936045d8a88f7e061a349ed1d73f5213d689e190f377a4bc15b28ca5c3d35c6242841c5647f1da060f0ace8fe73be969d1a309999c842cb63b9b86c0

  • SSDEEP

    6144:2OKlmpsf6bitr8fozSAVP9L99HptTo6rOeZtmWrzeXQw38546bNfjm:2gsf6MiyPZ99JVb1lz4Lsel

Score
9/10
collectiondiscoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      7dc19e400d1784dfb646ac55ff012359d1501d06fa968306a7462c414ab2ce45

    • Size

      356KB

    • MD5

      031a25a6e4fcfcc6835f4df2ffba3dc9

    • SHA1

      a28fe5dc28b7839bba8b61a5a3f2e56b531e26c3

    • SHA256

      7dc19e400d1784dfb646ac55ff012359d1501d06fa968306a7462c414ab2ce45

    • SHA512

      2efbd650936045d8a88f7e061a349ed1d73f5213d689e190f377a4bc15b28ca5c3d35c6242841c5647f1da060f0ace8fe73be969d1a309999c842cb63b9b86c0

    • SSDEEP

      6144:2OKlmpsf6bitr8fozSAVP9L99HptTo6rOeZtmWrzeXQw38546bNfjm:2gsf6MiyPZ99JVb1lz4Lsel

    Score
    9/10
    collectiondiscoverypersistencespywarestealerupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks