Overview

overview

10

Static

static

3

01a9f9baa6...ec.exe

windows7-x64

10

01a9f9baa6...ec.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    01a9f9baa64695cffce1206d71f6e0360de41ddbddbad129c2a405bd5c6653ec

  • Size

    2.0MB

  • Sample

    231013-a8gr1sgf2x

  • MD5

    f414f6563f0ebfd5e3315e7f38d34b2f

  • SHA1

    8c3cb57658e66bce0e34e43260b905523a45e4f9

  • SHA256

    01a9f9baa64695cffce1206d71f6e0360de41ddbddbad129c2a405bd5c6653ec

  • SHA512

    e012bacb67161b93010c1d54f25a34ef3f81cf8cf6f8cbf396d05fca6755a51f480939507691a0ca0679c41af1d45b3be50e9fb26b234d8cb7103b5e62fbb7bc

  • SSDEEP

    49152:2CPqNEpLpxnSsnHrcXy2m+8n9NRvSgtNE:NqNyPSsH

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      01a9f9baa64695cffce1206d71f6e0360de41ddbddbad129c2a405bd5c6653ec

    • Size

      2.0MB

    • MD5

      f414f6563f0ebfd5e3315e7f38d34b2f

    • SHA1

      8c3cb57658e66bce0e34e43260b905523a45e4f9

    • SHA256

      01a9f9baa64695cffce1206d71f6e0360de41ddbddbad129c2a405bd5c6653ec

    • SHA512

      e012bacb67161b93010c1d54f25a34ef3f81cf8cf6f8cbf396d05fca6755a51f480939507691a0ca0679c41af1d45b3be50e9fb26b234d8cb7103b5e62fbb7bc

    • SSDEEP

      49152:2CPqNEpLpxnSsnHrcXy2m+8n9NRvSgtNE:NqNyPSsH

    Score
    10/10
    evasionpersistencespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks