Overview

overview

10

Static

static

9a6062bd33...91.exe

windows7-x64

10

9a6062bd33...91.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9a6062bd333d4ff18d53622f32cb913761c30af292102ab03702749095442d91

  • Size

    646KB

  • Sample

    221204-bctblsge9z

  • MD5

    32e6dfaedf85e998e37b4222d26ad35b

  • SHA1

    85f3336dfe6b1bf1dca79676e38754834ff97a2c

  • SHA256

    9a6062bd333d4ff18d53622f32cb913761c30af292102ab03702749095442d91

  • SHA512

    30c46fbfc0a90c156383f73e25cf1d1b674cf4057ad6f60b5692224651d82c51ba98022602a86caa3d185dcd11d42cfe7ce9d91795517853f242581185f81206

  • SSDEEP

    12288:k/dr9yql7Xk+mO0FKUDTtMi1NzW/DaRMvNXx265syu4MrZ:kl8qNUyUdMONUzeosyu4M

Score
10/10
evasionpersistencespywarestealerupx

Malware Config

Targets

    • Target

      9a6062bd333d4ff18d53622f32cb913761c30af292102ab03702749095442d91

    • Size

      646KB

    • MD5

      32e6dfaedf85e998e37b4222d26ad35b

    • SHA1

      85f3336dfe6b1bf1dca79676e38754834ff97a2c

    • SHA256

      9a6062bd333d4ff18d53622f32cb913761c30af292102ab03702749095442d91

    • SHA512

      30c46fbfc0a90c156383f73e25cf1d1b674cf4057ad6f60b5692224651d82c51ba98022602a86caa3d185dcd11d42cfe7ce9d91795517853f242581185f81206

    • SSDEEP

      12288:k/dr9yql7Xk+mO0FKUDTtMi1NzW/DaRMvNXx265syu4MrZ:kl8qNUyUdMONUzeosyu4M

    Score
    10/10
    evasionpersistencespywarestealerupx

    • Modifies security service

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks