74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5
Size

190KB
Sample

221129-jmej7sda6x
MD5

dc29903126dc25b507e6acb19b0f9862
SHA1

7141ab5de0350991254954796b1fcc0b28a3d84d
SHA256

74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5
SHA512

99ceed709ff37fc4c7827d99d4e2dbc8f441517cf0fec618fa551c684d9f502c8e7f03faa8b49a483dfdf029cc33f29c183daa6bf7a5e49c6050588fba9654f3
SSDEEP

3072:te7HhzASQDcBIDBSEidva/4bUU60sZo2Ijql1Nc2Ti+l20IRPtrf2HPcq3cQ:tIHBIDBSXdJtsZp1Njl20eb2KQ

Score

8^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5
- Size
  
  190KB
- MD5
  
  dc29903126dc25b507e6acb19b0f9862
- SHA1
  
  7141ab5de0350991254954796b1fcc0b28a3d84d
- SHA256
  
  74829423bedefec14c64325250534c0803f910bb183ae1ec802d4724afa989d5
- SHA512
  
  99ceed709ff37fc4c7827d99d4e2dbc8f441517cf0fec618fa551c684d9f502c8e7f03faa8b49a483dfdf029cc33f29c183daa6bf7a5e49c6050588fba9654f3
- SSDEEP
  
  3072:te7HhzASQDcBIDBSEidva/4bUU60sZo2Ijql1Nc2Ti+l20IRPtrf2HPcq3cQ:tIHBIDBSXdJtsZp1Njl20eb2KQ
Score

8^/10

persistence spyware stealer
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2