xorist | 4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8 | Triage

Sharing

General

Target

4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe
Size

843KB
Sample

231012-t7ze8abh2v
MD5

871564bb0c6973e4eb3f4aafa368fabd
SHA1

da616d5082f810c153ba2ae5cb75a1a44778c57c
SHA256

4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8
SHA512

af92e1306dd61ea7a075aa522cc50b73462f240c979091a33d15b069d6ab928af5edccb032ff650459c75bb617b3c75fee6deb361840d59c60f8c62f4eeb7c05
SSDEEP

192:H/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMwu8V:HebFNw4Pk1itKkpAjjI2Ypdmw

Score

10^/10

xorist persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8.exe
- Size
  
  843KB
- MD5
  
  871564bb0c6973e4eb3f4aafa368fabd
- SHA1
  
  da616d5082f810c153ba2ae5cb75a1a44778c57c
- SHA256
  
  4509eb48fa6eb2117118bd33eaebfe190028e3d54976596878814031591dafe8
- SHA512
  
  af92e1306dd61ea7a075aa522cc50b73462f240c979091a33d15b069d6ab928af5edccb032ff650459c75bb617b3c75fee6deb361840d59c60f8c62f4eeb7c05
- SSDEEP
  
  192:H/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMwu8V:HebFNw4Pk1itKkpAjjI2Ypdmw
Score

9^/10

persistence ransomware spyware stealer
- Renames multiple (2144) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (2146) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

persistenceransomwarespywarestealer

behavioral2

persistenceransomwarespywarestealer