Overview

overview

8

Static

static

1

2023-03-15...te.exe

windows7-x64

8

2023-03-15...te.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2023-03-15_d28e88e6e9ad654f81909e605f3398c1_termite.exe

  • Size

    1.9MB

  • Sample

    230316-eymyhabc2z

  • MD5

    d28e88e6e9ad654f81909e605f3398c1

  • SHA1

    84726882c606eec6b7ed7d0ba1d9acdd13390e45

  • SHA256

    38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c

  • SHA512

    3e971529338ef0576ce40679b33fb763b2e1f3e7c16255b922434baf486d6569ee1e0770959ba7763b9759d89bf55b149d54546bdfa7299c41fd2c5d302ecaf7

  • SSDEEP

    24576:tnxLSUXY7WSIGgjvvYaxKMiZA+yH6uw1ECvGX6H7O3YpPNaG:txOUpSIZDv1xim+y6HLOO3

Score
8/10
discoveryexploitpersistencespywarestealer

Malware Config

Targets

    • Target

      2023-03-15_d28e88e6e9ad654f81909e605f3398c1_termite.exe

    • Size

      1.9MB

    • MD5

      d28e88e6e9ad654f81909e605f3398c1

    • SHA1

      84726882c606eec6b7ed7d0ba1d9acdd13390e45

    • SHA256

      38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c

    • SHA512

      3e971529338ef0576ce40679b33fb763b2e1f3e7c16255b922434baf486d6569ee1e0770959ba7763b9759d89bf55b149d54546bdfa7299c41fd2c5d302ecaf7

    • SSDEEP

      24576:tnxLSUXY7WSIGgjvvYaxKMiZA+yH6uw1ECvGX6H7O3YpPNaG:txOUpSIZDv1xim+y6HLOO3

    Score
    8/10
    discoveryexploitpersistencespywarestealer

    • Possible privilege escalation attempt

      exploit

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks