86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c | Triage

Submit
Reports

Overview

overview

8

Static

static

86d594a919...5c.exe

windows7-x64

8

86d594a919...5c.exe

windows10-2004-x64

8

Resubmissions

01-12-2022 15:34

221201-szv76acd49 8

25-11-2022 00:06

221125-adzdksgh95 8

Sharing

General

Target

86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c
Size

1018KB
Sample

221201-szv76acd49
MD5

276581677edbb8f7e55159c55c290287
SHA1

dc026b7197f21ad74efb6a041542d47a96153967
SHA256

86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c
SHA512

6bead85b683648176235921a62afa50b08b69a92ce36da36de302297d5110c48c5d591d018b25e881fee80809232359e76cb1fd7aed0941b973dbbfc31146966
SSDEEP

24576:hYHs/v206iB2Fj+NP8S6uwnUYlkHwb5jPHOIA/jGic4XgVhkW:h0s36iBej+uS6W7Hwb5j/OIujGfm8hkW

Score

8^/10

collection discovery persistence spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c.exe

Resource

win7-20220901-en

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c.exe

Resource

win10v2004-20220901-en

collection discovery persistence spyware stealer

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Targets

- Target
  
  86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c
- Size
  
  1018KB
- MD5
  
  276581677edbb8f7e55159c55c290287
- SHA1
  
  dc026b7197f21ad74efb6a041542d47a96153967
- SHA256
  
  86d594a91959281820b87bf1ecae58fe3822977ebaba3500184c57e2f6eb585c
- SHA512
  
  6bead85b683648176235921a62afa50b08b69a92ce36da36de302297d5110c48c5d591d018b25e881fee80809232359e76cb1fd7aed0941b973dbbfc31146966
- SSDEEP
  
  24576:hYHs/v206iB2Fj+NP8S6uwnUYlkHwb5jPHOIA/jGic4XgVhkW:h0s36iBej+uS6W7Hwb5j/OIujGfm8hkW
Score

8^/10

discovery collection persistence spyware stealer
- Blocklisted process makes network request
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

collectiondiscoverypersistencespywarestealer

© 2018-2024

Terms | Privacy