14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931 | Triage

Submit
Reports

Overview

overview

Static

static

14aecd45fb...31.exe

windows7-x64

14aecd45fb...31.exe

windows10-2004-x64

Sharing

General

Target

14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931
Size

596KB
Sample

221127-qm4mnaah36
MD5

8b9cea8590ed25966ec2c45f9d923a46
SHA1

9ef5ae95749239e4f3eaf142a3ff0b8eed291320
SHA256

14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931
SHA512

bc7cf5cc8d46ed2d5f574f7b633d1fbfe4d65de74f48a5dfa702b323a6719978de80cdb3f78f0c4790ef1793c7e06dc5fe8897b283c0898d0eeb6d662a7111f9
SSDEEP

12288:MkIG6J6tqhOb4PvlxNavuBRaNX1T1sAIsKf4lFn9n/eJyrvWFTUWBOAYIe:VIG7qTav08BCf49mJy1W3e

Score

10^/10

collection evasion spyware stealer trojan

Static task

static1

Behavioral task

behavioral1

Sample

14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931.exe

Resource

win7-20220812-en

collection evasion spyware stealer trojan

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931.exe

Resource

win10v2004-20220812-en

collection evasion trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931
- Size
  
  596KB
- MD5
  
  8b9cea8590ed25966ec2c45f9d923a46
- SHA1
  
  9ef5ae95749239e4f3eaf142a3ff0b8eed291320
- SHA256
  
  14aecd45fb908687ddedf6aa14424e3a8428e7ef1c7e28cb25291507d2b0f931
- SHA512
  
  bc7cf5cc8d46ed2d5f574f7b633d1fbfe4d65de74f48a5dfa702b323a6719978de80cdb3f78f0c4790ef1793c7e06dc5fe8897b283c0898d0eeb6d662a7111f9
- SSDEEP
  
  12288:MkIG6J6tqhOb4PvlxNavuBRaNX1T1sAIsKf4lFn9n/eJyrvWFTUWBOAYIe:VIG7qTav08BCf49mJy1W3e
Score

10^/10

collection evasion spyware stealer trojan
- UAC bypass
  evasion trojan
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

collectionevasionspywarestealertrojan

behavioral2

collectionevasiontrojan

© 2018-2024

Terms | Privacy