4ec1ead75385f684740372f0ba6b5ca891cd89fb17b92904b9b3592f34939ae0 | Triage

Sharing

General

Target

Yeni siparis eklendi.exe
Size

717KB
Sample

231011-hfnnvsfd7t
MD5

be581b483cc7452d59e1f246615911a3
SHA1

8fa2767e25635a8225f422d6fb54dde7bf80186f
SHA256

4ec1ead75385f684740372f0ba6b5ca891cd89fb17b92904b9b3592f34939ae0
SHA512

2ae5b3aab82c99968bef64f8226a018f418c58a3994a8f1f1925346ca5a896207c95f588e7821005f94fa25dbea0c40332d5de699097afb49a3dd62575a5445d
SSDEEP

12288:aQp+Uw9MMMDMMMrhjsOsAvExgOI4br9rAHWKd3RXPWy25ttyYVQCU:EMMMDMMMrZsfTxgANraFXPr25ttyCQC

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  Yeni siparis eklendi.exe
- Size
  
  717KB
- MD5
  
  be581b483cc7452d59e1f246615911a3
- SHA1
  
  8fa2767e25635a8225f422d6fb54dde7bf80186f
- SHA256
  
  4ec1ead75385f684740372f0ba6b5ca891cd89fb17b92904b9b3592f34939ae0
- SHA512
  
  2ae5b3aab82c99968bef64f8226a018f418c58a3994a8f1f1925346ca5a896207c95f588e7821005f94fa25dbea0c40332d5de699097afb49a3dd62575a5445d
- SSDEEP
  
  12288:aQp+Uw9MMMDMMMrhjsOsAvExgOI4br9rAHWKd3RXPWy25ttyYVQCU:EMMMDMMMrZsfTxgANraFXPr25ttyCQC
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2