Overview

overview

10

Static

static

3

iexplore.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iexplore.exe

  • Size

    352KB

  • Sample

    230622-lpyrzadf76

  • MD5

    95cdb3027de236e33d32fff9a3786c2f

  • SHA1

    173b3dcac22e92a272a8ce228730072b4339e2ce

  • SHA256

    33d29e4ca7eefcd1df148075c8765de6bd941faccbd2a1c5219d11cc5193fd68

  • SHA512

    ce25b51ddf5fc187ab438dc51e2bab97ba41903087ba8308c7fb3a3f627bc9cc17f58cd5be1b40e3eee7f3fe68b688644ffef08d0e6a09e6d35c6b8c21278708

  • SSDEEP

    6144:YZZC6Tf4RnqqfjkKlirFC1jGVr9nOhKy0zIBd6CiBP0PfL+eDHSVJs0z9LjS7g:ONTwxIKlirY1jAy0MjPi2Pj+oA/2

Score
10/10
windealerdiscoveryevasionspywarestealertrojan

Malware Config

Targets

    • Target

      iexplore.exe

    • Size

      352KB

    • MD5

      95cdb3027de236e33d32fff9a3786c2f

    • SHA1

      173b3dcac22e92a272a8ce228730072b4339e2ce

    • SHA256

      33d29e4ca7eefcd1df148075c8765de6bd941faccbd2a1c5219d11cc5193fd68

    • SHA512

      ce25b51ddf5fc187ab438dc51e2bab97ba41903087ba8308c7fb3a3f627bc9cc17f58cd5be1b40e3eee7f3fe68b688644ffef08d0e6a09e6d35c6b8c21278708

    • SSDEEP

      6144:YZZC6Tf4RnqqfjkKlirFC1jGVr9nOhKy0zIBd6CiBP0PfL+eDHSVJs0z9LjS7g:ONTwxIKlirY1jAy0MjPi2Pj+oA/2

    Score
    10/10
    windealerdiscoveryevasionspywarestealertrojan

    • Detect WinDealer information stealer

      stealer

    • WinDealer

      WinDealer is an info stealer used by LuoYu group.

      stealertrojanwindealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks