7e1a6f277aa6da8ba642970267c1f6921dc2a075442b6b4069a3af9439b95914 | Triage

Sharing

General

Target

7e1a6f277aa6da8ba642970267c1f6921dc2a075442b6b4069a3af9439b95914
Size

183KB
Sample

221128-gs41yafc7t
MD5

65acc5a3a0c9b7aad29e3d3ff64691a7
SHA1

3e12eb0c6a4032b44008ff7f23b9ded73b8d06ae
SHA256

7e1a6f277aa6da8ba642970267c1f6921dc2a075442b6b4069a3af9439b95914
SHA512

aec411b23bb254f81620d29327a8661a57deccf0abae498980fd6bd3ee8831dd6e0b3fa3fbb165764389a4e3d2a74f0ce4af470a28b220efc1d7dc710ce48553
SSDEEP

3072:6pMG+JvtcknLUAiow8j5pLxiASDTVnrTOvBnRltfjx37Wfzg1pNVjW:mMbRukLcled2TtrsBpV7Wfzg1DVi

Score

8^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  7e1a6f277aa6da8ba642970267c1f6921dc2a075442b6b4069a3af9439b95914
- Size
  
  183KB
- MD5
  
  65acc5a3a0c9b7aad29e3d3ff64691a7
- SHA1
  
  3e12eb0c6a4032b44008ff7f23b9ded73b8d06ae
- SHA256
  
  7e1a6f277aa6da8ba642970267c1f6921dc2a075442b6b4069a3af9439b95914
- SHA512
  
  aec411b23bb254f81620d29327a8661a57deccf0abae498980fd6bd3ee8831dd6e0b3fa3fbb165764389a4e3d2a74f0ce4af470a28b220efc1d7dc710ce48553
- SSDEEP
  
  3072:6pMG+JvtcknLUAiow8j5pLxiASDTVnrTOvBnRltfjx37Wfzg1pNVjW:mMbRukLcled2TtrsBpV7Wfzg1DVi
Score

8^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2