1d0799de8e01ed4b223ed6e00d6e51cf8fcfc3142b9b794a901fb9baa3b4ecda | Triage

Sharing

General

Target

36f0e4ed75a4cbbe79b1a7105bbb3995.exe
Size

13KB
Sample

240110-x13qvafcd6
MD5

36f0e4ed75a4cbbe79b1a7105bbb3995
SHA1

f9c8792aa1d0544a41effe50d0c33378bd977a5c
SHA256

1d0799de8e01ed4b223ed6e00d6e51cf8fcfc3142b9b794a901fb9baa3b4ecda
SHA512

c19fd65c087d2946f4045535dc21ed52e9e8fc15b049479d1af00207558c010e9d5921e5765bb3136d9d1e982cecc4cfadb0db4b10705be4d8e8586a54dcb47d
SSDEEP

192:m51V1upEMYREAW6tHwK1igssEcX4jXv+quAOhWEUmJA0B/CPd1jjkEp0hq:U/EA11MpXvagqkbjjkk0Q

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Targets

- Target
  
  36f0e4ed75a4cbbe79b1a7105bbb3995.exe
- Size
  
  13KB
- MD5
  
  36f0e4ed75a4cbbe79b1a7105bbb3995
- SHA1
  
  f9c8792aa1d0544a41effe50d0c33378bd977a5c
- SHA256
  
  1d0799de8e01ed4b223ed6e00d6e51cf8fcfc3142b9b794a901fb9baa3b4ecda
- SHA512
  
  c19fd65c087d2946f4045535dc21ed52e9e8fc15b049479d1af00207558c010e9d5921e5765bb3136d9d1e982cecc4cfadb0db4b10705be4d8e8586a54dcb47d
- SSDEEP
  
  192:m51V1upEMYREAW6tHwK1igssEcX4jXv+quAOhWEUmJA0B/CPd1jjkEp0hq:U/EA11MpXvagqkbjjkk0Q
Score

10^/10

evasion persistence spyware stealer trojan upx
- Modifies security service
  evasion
- Windows security bypass
  evasion trojan
- Blocklisted process makes network request
- Modifies Shared Task Scheduler registry keys
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencespywarestealertrojanupx

behavioral2