Overview

overview

8

Static

static

1

Restoro.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08333e61156e2ccfd7843a924fb671862fc226c89bf98f20ab95ea6125130ef7.zip

  • Size

    617KB

  • Sample

    230721-xcv14ahb2z

  • MD5

    396185ffdbaf438f5e3ae3a7611bfb63

  • SHA1

    3824d1d89cb292d090cc8e0b83bba339c1a4ca69

  • SHA256

    34b48c7e6ad8660f9ea61a013cea58e79af8bed4a68c599f6d30192cdcd1da9b

  • SHA512

    4bd4a3fa5aca0e322073da3003a3ba5e546c694b76a372c9e112c1f5df0743977dcb341e442d2a924b4cef70f814d4d81fe75c9e52cb933afe6ca004285e4157

  • SSDEEP

    12288:QMKaA3usB4zwoEdEeXQeYhkcI7D+5VslwuXnAmjvjQnOr2:tK3eVzwoEdEeXjXI5VKXnNMnz

Score
8/10
discoverypersistencespywarestealerupx

Malware Config

Targets

    • Target

      Restoro.exe

    • Size

      910KB

    • MD5

      39fef85fe114d96dde745b8ce0659b2e

    • SHA1

      c30e2b541a5268f731824342dc3c3c02671891d7

    • SHA256

      08333e61156e2ccfd7843a924fb671862fc226c89bf98f20ab95ea6125130ef7

    • SHA512

      b5ecb8f469ed8ea2b351b7333356b15f0c73e3101052aa2dbcda8db00b9eabf94f1523601cab71dadb5ac83581f18c76f43ff704355be96af0a981567b9f6bab

    • SSDEEP

      12288:SEiLRLvq1HB+OP6YyUCRXXzE4tyMgq/q7dps1XG2YZhH30DVUr0JImhySZP9ZerJ:StRLvGTK1RzE4t7D1Y4VUwJ77P4J

    Score
    8/10
    discoverypersistencespywarestealerupx

    • Downloads MZ/PE file

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks