ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50 | Triage

Sharing

General

Target

ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50
Size

120KB
Sample

221203-atezwahf78
MD5

9e2d5116462c18c2a8b0dcb7bd88e9ca
SHA1

74ca2e701aae44413e3706a37ff44ebbe6c0e19d
SHA256

ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50
SHA512

43da95509dfebfc6908e0fdd27c22c1e4e806b814103cb1c53386e0e4da222c4b918a7050c5eb2941a9110042de0d0f2de95a6086b64b22aebef4ce796344ee3
SSDEEP

1536:WlnMg9bWAdy4nHfUHD28+we3cotuFDcF4DfQKRx50KVT4iKEFXvxKqHs:WlNsAdy4n/UKw4co9FMfQeN/Xey

Score

9^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50
- Size
  
  120KB
- MD5
  
  9e2d5116462c18c2a8b0dcb7bd88e9ca
- SHA1
  
  74ca2e701aae44413e3706a37ff44ebbe6c0e19d
- SHA256
  
  ced4ccbb2cf94c8413da7ec41eeb9c404840c50de096a788024e9828db55ca50
- SHA512
  
  43da95509dfebfc6908e0fdd27c22c1e4e806b814103cb1c53386e0e4da222c4b918a7050c5eb2941a9110042de0d0f2de95a6086b64b22aebef4ce796344ee3
- SSDEEP
  
  1536:WlnMg9bWAdy4nHfUHD28+we3cotuFDcF4DfQKRx50KVT4iKEFXvxKqHs:WlNsAdy4n/UKw4co9FMfQeN/Xey
Score

9^/10

persistence spyware stealer
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Account Manipulation

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Account Manipulation

Credentials in Files

Discovery

Process Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2