Overview

overview

10

Static

static

3

1d0dd652b5...JC.exe

windows7-x64

10

1d0dd652b5...JC.exe

windows10-2004-x64

10

Resubmissions

14-07-2023 15:02

230714-semehsff2s 10

14-07-2023 15:02

230714-sek7fsef72 10

14-07-2023 15:01

230714-seckbafe9z 10

14-07-2023 15:01

230714-sd9tesef69 10

14-07-2023 15:01

230714-sd7ztsfe9w 10

14-07-2023 15:01

230714-sd6f1afe9t 10

14-07-2023 15:01

230714-sd5jpsef67 10

14-07-2023 15:01

230714-sd4bmsef66 10

14-07-2023 15:01

230714-sd3ecaef65 10

14-07-2023 15:01

230714-sd17aaef63 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d0dd652b53ef9exe_JC.exe

  • Size

    533KB

  • Sample

    230714-semehsff2s

  • MD5

    1d0dd652b53ef9e5b4e006c9d7b4f667

  • SHA1

    950b313ce1ec4e1e66337475d54c92fa95888480

  • SHA256

    81a741df4e1494e6a50695109ed0bd78da1dec2cf68b64e42c695caddfdf3146

  • SHA512

    0a359c8b3dc150fe6c84f9a9278f1445f80dac8fc5ca26e308a8de2e676862c0fdca4fd5c029509b35f32d8062ca53b8a390326abab23d75744ed2f348aa0ded

  • SSDEEP

    12288:z64JVMAmgLKT4ABmjxegymxWW+Aqe9smE6xIiCRUkUEsjhQtkISeKzBg8eaLWGsU:zKOeYapaWz2OFcp

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      1d0dd652b53ef9exe_JC.exe

    • Size

      533KB

    • MD5

      1d0dd652b53ef9e5b4e006c9d7b4f667

    • SHA1

      950b313ce1ec4e1e66337475d54c92fa95888480

    • SHA256

      81a741df4e1494e6a50695109ed0bd78da1dec2cf68b64e42c695caddfdf3146

    • SHA512

      0a359c8b3dc150fe6c84f9a9278f1445f80dac8fc5ca26e308a8de2e676862c0fdca4fd5c029509b35f32d8062ca53b8a390326abab23d75744ed2f348aa0ded

    • SSDEEP

      12288:z64JVMAmgLKT4ABmjxegymxWW+Aqe9smE6xIiCRUkUEsjhQtkISeKzBg8eaLWGsU:zKOeYapaWz2OFcp

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks