e225b3017e0e35a66498fa9dc7adbae71f2c32ca84104f2a93b8890c8c2d8a66 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VirusShare_997e7aaaf3dc9dbeca0e95f50d3ecb45
Size 634KB
Sample240204-pc9kgsbben
SHA256 e225b3017e0e35a66498fa9dc7adbae71f2c32ca84104f2a93b8890c8c2d8a66
MD5 997e7aaaf3dc9dbeca0e95f50d3ecb45
SHA1 7ec5b24a09567a550ce8cc039ae71606f2f31b29
SHA512 1a9f15ae6befa67ee8f2d8812919fd89161ed2a0095a87321c74212e951c75008913650f3ad13c3116d5c290d0fca6a25d74beb0a63df2f9183471ac998f2895
SSDEEP 12288:f6FuZcG4GjeZHkwuPikQ7lKH5p5H9x1VeZHkwu/iJQ5lKL5p6CsQzuPYt:f6dG4GjeZEXi37l6Br1VeZE3ie5lYyCL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Targets

- Target
  VirusShare_997e7aaaf3dc9dbeca0e95f50d3ecb45
- Size 634KB
- SHA256 e225b3017e0e35a66498fa9dc7adbae71f2c32ca84104f2a93b8890c8c2d8a66
- MD5 997e7aaaf3dc9dbeca0e95f50d3ecb45
- SHA1 7ec5b24a09567a550ce8cc039ae71606f2f31b29
- SHA512 1a9f15ae6befa67ee8f2d8812919fd89161ed2a0095a87321c74212e951c75008913650f3ad13c3116d5c290d0fca6a25d74beb0a63df2f9183471ac998f2895
- SSDEEP 12288:f6FuZcG4GjeZHkwuPikQ7lKH5p5H9x1VeZHkwu/iJQ5lKL5p6CsQzuPYt:f6dG4GjeZEXi37l6Br1VeZE3ie5lYyCL
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  ffMediaWatchV1home872chaction.js
- Size 829B
- SHA256 bc242ed84fc287b8524b301e5d2afcdb4ab60ad6119ab6b38ad6ed95d39709b8
- MD5 ed26e48df5878fb722c618c98c71c52b
- SHA1 bc0efc7d7d5cce14712a073c14be17fc00945036
- SHA512 7f4fb7db1a53f75a35adc48c537548fbd210c511f7cee65ade20257aae3075d3cdd0f79ae5a3a22da1794937da117e36482825a10892e6d9d018cb60f0a02a1c
- MD5 SHA1 SHA512
Score

1^/10
behavioral5 behavioral6
- Target
  ff/chrome/content/ffMediaWatchV1home872.js
- Size 744B
- SHA256 31766102d09320dc74d1841c2a00330957affa59089f55116abed4863e7dbb2e
- MD5 6e5c701e0d2f8ab921ea55cf66facdd4
- SHA1 994b0d449e0ed23b9c0ff219d573e642544ac007
- SHA512 bb38bc10514df59273b124a5a33c1071564fc42338580eea4aa87d476a29e0df47ef0ad87abbfae6333b3386042993fd27a236500ab24fa8f1d3a8acf8743c3d
- MD5 SHA1 SHA512
Score

1^/10
behavioral7 behavioral8
- Target
  ff/chrome/content/ffMediaWatchV1home872ffaction.js
- Size 674B
- SHA256 febe5a898bdf8d2a0ead3c93aad617839d673c94bbc522396db2582261ac90a0
- MD5 d4a7b7720b28320fdbdd203a1c9f5d41
- SHA1 3c383a6f305f355f670d7e6b1dac2a06c41b1f7f
- SHA512 bdf2015a3aac65b5d282f3f7e79375eddd9fd1c52bf98b802d479fa5a335231df6e728d07109b349c4d2a32e12d3efd433b35cbf6fd28b12883364a8152379c1
- MD5 SHA1 SHA512
Score

1^/10
behavioral10 behavioral9
- Target
  ie/MediaWatchV1home872.dll
- Size 85KB
- SHA256 da087b7fa4e14784223b11732ad51e4a5f9b6a29ea9d1ae68d3b638e05be257f
- MD5 87416d2bff45bfe8aa63281895277d70
- SHA1 cbf3f3b2fb6ff7c93cd14add625d8e16962f6b69
- SHA512 a341b8a58df30e6cbd59c84df3fdfda36cd243e69eafe186ad76e9005a2b4c4d1fd5fa924fd6de59567ad88a7ae3cc8198a14f77e5ce7bb6f11db0b4107d16a2
- SSDEEP 1536:f3flScQkGMA5tasrOb8Dk9tgHgNglQYkD1:nlikGMAbasrORgA+aYkR
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  uninstall.exe
- Size 285KB
- SHA256 192b7b13e8591df8a138a34a56c1c8df6f71d84378c67cf885669aed9fe19119
- MD5 1f53944af9a0a56ed34b24856e322a35
- SHA1 2d7955eff203ce80b7b2b3407b7575a721a6559c
- SHA512 fdf4e41670c22f05853c1b4e19f32ae6f96fc9e34c2a88faf8d7b067c21ad139285f830da3b94ac039c5b838055a065c11e0b1bfb638ed9f02021e32504f5197
- SSDEEP 6144:Ee34grpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1B:FFeZHkwuPikQ7lKH5p5H9x1B
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral13 behavioral14
- Target
  $PLUGINSDIR/aminsis.dll
- Size 559KB
- SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
- MD5 51ba1095f0ae45a2d444bea506cb9ad4
- SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
- SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
- SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16