Overview

overview

8

Static

static

a368e3a61d...92.dll

windows7-x64

8

a368e3a61d...92.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a368e3a61d29ac9632de94d2cba2af05e276abd1a1f40e6cb2dbaf031a5e1092

  • Size

    476KB

  • Sample

    221202-14s8cshg75

  • MD5

    528e47674cc43c15d7bbbb75e5e34403

  • SHA1

    5b0a30fb58184f584ecf9decf315594e55f372cc

  • SHA256

    a368e3a61d29ac9632de94d2cba2af05e276abd1a1f40e6cb2dbaf031a5e1092

  • SHA512

    1d9999d145e60e0d794c1a1bf8492b8965f9fa78ef684f2479207c6055e6e5300b29bc6ed6c718c30a43681b7288764b5087e8834dade6547c63aa1d609bdc06

  • SSDEEP

    12288:oIx3n4BiTNvjruygK2QR+cRxvcfMRjRTOi48:oIx3JNLrAK7X8fMxRTOi4

Score
8/10
adwarebootkitpersistencestealer

Malware Config

Targets

    • Target

      a368e3a61d29ac9632de94d2cba2af05e276abd1a1f40e6cb2dbaf031a5e1092

    • Size

      476KB

    • MD5

      528e47674cc43c15d7bbbb75e5e34403

    • SHA1

      5b0a30fb58184f584ecf9decf315594e55f372cc

    • SHA256

      a368e3a61d29ac9632de94d2cba2af05e276abd1a1f40e6cb2dbaf031a5e1092

    • SHA512

      1d9999d145e60e0d794c1a1bf8492b8965f9fa78ef684f2479207c6055e6e5300b29bc6ed6c718c30a43681b7288764b5087e8834dade6547c63aa1d609bdc06

    • SSDEEP

      12288:oIx3n4BiTNvjruygK2QR+cRxvcfMRjRTOi48:oIx3JNLrAK7X8fMxRTOi4

    Score
    8/10
    adwarebootkitpersistencestealer

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks