be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b | Triage

Sharing

General

Target

be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b
Size

306KB
Sample

221201-w5ghqsbf6v
MD5

b4d31796460de48099b671560fcc3499
SHA1

f461422b898da0e0c2f5154e8af4f17889011fd0
SHA256

be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b
SHA512

c9bcdf8edd7af02e154e53035817561f1c5a4a7801d73a884f41d79ce253756d063d89bbc68b0af37e41efa12288c28b374aa0a4a069e69c7a18f0e764a41f14
SSDEEP

6144:YOUyfOlOeb65u5BLxllHFh36pST6pz7FvAuHSX:YOUyCmA5BLbZLqQT65SX

Score

8^/10

adware persistence stealer

Malware Config

Targets

- Target
  
  be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b
- Size
  
  306KB
- MD5
  
  b4d31796460de48099b671560fcc3499
- SHA1
  
  f461422b898da0e0c2f5154e8af4f17889011fd0
- SHA256
  
  be9eb79afcf743a7cce147f8597de824a3801405058ebe5f1c93a3e2be8ed46b
- SHA512
  
  c9bcdf8edd7af02e154e53035817561f1c5a4a7801d73a884f41d79ce253756d063d89bbc68b0af37e41efa12288c28b374aa0a4a069e69c7a18f0e764a41f14
- SSDEEP
  
  6144:YOUyfOlOeb65u5BLxllHFh36pST6pz7FvAuHSX:YOUyCmA5BLbZLqQT65SX
Score

8^/10

adware persistence stealer
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarepersistencestealer

behavioral2

adwarepersistencestealer