Overview

overview

10

Static

static

8

a4f1192af6...52.exe

windows7-x64

10

a4f1192af6...52.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a4f1192af6d2f9c27051fa2cd45f13a0dbed3355bd8fbbb49d248f6897762d52

  • Size

    6.8MB

  • Sample

    221205-m4xc5age3w

  • MD5

    6d6a2efb85fc8dd45ff1fd1f4bacdb0f

  • SHA1

    a8df683e025454b7bfe9a89cff388a78081a3ae8

  • SHA256

    a4f1192af6d2f9c27051fa2cd45f13a0dbed3355bd8fbbb49d248f6897762d52

  • SHA512

    e254e72c1fa4b82e55cfd8903bb907e288d7e60259bb48bd5d2028002828d613d5daba0720236adab95dbc4954dbb9e9e47d04dbd20870a64a3107bce8b7cc23

  • SSDEEP

    196608:47effIPEsy58doQaTzwZ8Jq3QKnqVtxQLizl/sJEl2if8sHQoddmbKGAryfEQuQo:47effIPEsy58doQaTzwZ8Jq3QKnqVtx1

Score
10/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      a4f1192af6d2f9c27051fa2cd45f13a0dbed3355bd8fbbb49d248f6897762d52

    • Size

      6.8MB

    • MD5

      6d6a2efb85fc8dd45ff1fd1f4bacdb0f

    • SHA1

      a8df683e025454b7bfe9a89cff388a78081a3ae8

    • SHA256

      a4f1192af6d2f9c27051fa2cd45f13a0dbed3355bd8fbbb49d248f6897762d52

    • SHA512

      e254e72c1fa4b82e55cfd8903bb907e288d7e60259bb48bd5d2028002828d613d5daba0720236adab95dbc4954dbb9e9e47d04dbd20870a64a3107bce8b7cc23

    • SSDEEP

      196608:47effIPEsy58doQaTzwZ8Jq3QKnqVtxQLizl/sJEl2if8sHQoddmbKGAryfEQuQo:47effIPEsy58doQaTzwZ8Jq3QKnqVtx1

    Score
    10/10
    adwarepersistencestealerupx

    • Modifies WinLogon for persistence

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks