Overview

overview

10

Static

static

e15a679241...8f.exe

windows7-x64

10

e15a679241...8f.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    e15a679241dc86c16cede7dddc2758bfd63c2e56dcba064c100b3d637d03cc8f

  • Size

    240KB

  • Sample

    221204-q769aaec82

  • MD5

    272a2d647b84469483d1d2b8941de360

  • SHA1

    3da05a955f9380e20580efca477b61e6b6a958ad

  • SHA256

    e15a679241dc86c16cede7dddc2758bfd63c2e56dcba064c100b3d637d03cc8f

  • SHA512

    9cca79a344df1ffe826ca88f29a25719822e2c85ef0d60a7ef9713d965bbfd9d77838dafdf72ce2f1ebc00e1da513e28d7ec2574644b0bad47c54773c864c38d

  • SSDEEP

    1536:YKNLWlngkYFKynXvAh1MFOMLwOueYdqXhVBZXcMik421dNSkWNVYM3O3:YaQgk6Kyn/wMFOMLN9AQdjWzT+

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      e15a679241dc86c16cede7dddc2758bfd63c2e56dcba064c100b3d637d03cc8f

    • Size

      240KB

    • MD5

      272a2d647b84469483d1d2b8941de360

    • SHA1

      3da05a955f9380e20580efca477b61e6b6a958ad

    • SHA256

      e15a679241dc86c16cede7dddc2758bfd63c2e56dcba064c100b3d637d03cc8f

    • SHA512

      9cca79a344df1ffe826ca88f29a25719822e2c85ef0d60a7ef9713d965bbfd9d77838dafdf72ce2f1ebc00e1da513e28d7ec2574644b0bad47c54773c864c38d

    • SSDEEP

      1536:YKNLWlngkYFKynXvAh1MFOMLwOueYdqXhVBZXcMik421dNSkWNVYM3O3:YaQgk6Kyn/wMFOMLN9AQdjWzT+

    Score
    10/10
    evasionpersistencespywarestealertrojanupx

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables taskbar notifications via registry modification

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks