3ba7c1a01fe40fab7b53ae3a50aaba4f1d1300a857f4b91352f2423a3f7a4cb2 | Triage

Sharing

General

Target

tmp
Size

737KB
Sample

231011-25wkjsba3y
MD5

d54ddeb1ceaa4b97d777db0335765e31
SHA1

e7d5613db327190562de2c627afceef830195f6c
SHA256

3ba7c1a01fe40fab7b53ae3a50aaba4f1d1300a857f4b91352f2423a3f7a4cb2
SHA512

6d07511e8e97896b98b7dfe16adfd19027aff7d7c9b0ec221a5165be28e52d7cd659692ab0ad52db02addc0f0213e60d3fcc9eb9d0bcde1353a52b63e01115aa
SSDEEP

12288:f06gzHa2iNP1U8kM7j418EZYw4lB/brrGL98Muv6DXfuADUkySTLs7Tn:8TG1FDOTZYlhrGL98MJDUkRTL4z

Score

8^/10

spyware stealer

Malware Config

Targets

- Target
  
  tmp
- Size
  
  737KB
- MD5
  
  d54ddeb1ceaa4b97d777db0335765e31
- SHA1
  
  e7d5613db327190562de2c627afceef830195f6c
- SHA256
  
  3ba7c1a01fe40fab7b53ae3a50aaba4f1d1300a857f4b91352f2423a3f7a4cb2
- SHA512
  
  6d07511e8e97896b98b7dfe16adfd19027aff7d7c9b0ec221a5165be28e52d7cd659692ab0ad52db02addc0f0213e60d3fcc9eb9d0bcde1353a52b63e01115aa
- SSDEEP
  
  12288:f06gzHa2iNP1U8kM7j418EZYw4lB/brrGL98Muv6DXfuADUkySTLs7Tn:8TG1FDOTZYlhrGL98MJDUkRTL4z
Score

8^/10

spyware stealer
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2