Overview

overview

7

Static

static

3

b6bfc7dc51...d2.exe

windows7-x64

7

b6bfc7dc51...d2.exe

windows10-2004-x64

7

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/$S...4_.exe

windows7-x64

7

$SYSDIR/$S...4_.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows7-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$SYSDIR/$S...8_.dll

windows7-x64

6

$SYSDIR/$S...8_.dll

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6bfc7dc51fe1be7283ed92aa7d523d2

  • Size

    201KB

  • Sample

    240306-hc1t1sdc5t

  • MD5

    b6bfc7dc51fe1be7283ed92aa7d523d2

  • SHA1

    47d3593f8afca4693cbd4a9dbe6bf30b362774f9

  • SHA256

    669385dcbf0bee44f50ddcf36981d1d4ca0aa88bbc503af97766ab7b4f0417ad

  • SHA512

    2bc1bd50b3b82941cff52e2e1a14e392d53b4ea7747842d1b97c4fc3ff5c916aacba28374b07a58461ac94d1a784a61161e6fb07c2621110f061e8bf939d0c64

  • SSDEEP

    6144:i+YiDDitC24iMIblprbkEXgeKWJxhdYeBqd0:7DitC24inTbhXgeKKvlBZ

Score
7/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target

      b6bfc7dc51fe1be7283ed92aa7d523d2

    • Size

      201KB

    • MD5

      b6bfc7dc51fe1be7283ed92aa7d523d2

    • SHA1

      47d3593f8afca4693cbd4a9dbe6bf30b362774f9

    • SHA256

      669385dcbf0bee44f50ddcf36981d1d4ca0aa88bbc503af97766ab7b4f0417ad

    • SHA512

      2bc1bd50b3b82941cff52e2e1a14e392d53b4ea7747842d1b97c4fc3ff5c916aacba28374b07a58461ac94d1a784a61161e6fb07c2621110f061e8bf939d0c64

    • SSDEEP

      6144:i+YiDDitC24iMIblprbkEXgeKWJxhdYeBqd0:7DitC24inTbhXgeKKvlBZ

    Score
    7/10
    adwarediscoverypersistencestealer

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      f0e51d5722c11a4fe40c97b746c1ffc5

    • SHA1

      8ec31853e9ef08fdc2a8c3c8eaa5f5b9469af193

    • SHA256

      93a27f96055ae6b7f44916e13487b0efa7cd6d762e6768f7cb6427e32bda777d

    • SHA512

      212c1ed753b54e5eccf7e1421bcca86955e09d6e3873f891d3d7076e21f79feb5f1dba350818804a215980875c306283b02f628fbc191d958f0de0f528c7194a

    • SSDEEP

      192:94lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12/gszA:9ysdM80dCI5a2LsQ5IlPNRY00AlAxU

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      7e3c808299aa2c405dffa864471ddb7f

    • SHA1

      b5de7804dd35ed7afd0c3b59d866f1a0749495e0

    • SHA256

      91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd

    • SHA512

      599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738

    • SSDEEP

      192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw

    Score
    3/10
    behavioral5behavioral6

    • Target

      $SYSDIR/$SYSDIR/$_14_.exe

    • Size

      76KB

    • MD5

      c7e4afdb7378f0c2e9029ce1017d9c03

    • SHA1

      5f423590d309ee6204bb9ffa89b9ac85197c7c76

    • SHA256

      3d3df291b230dea3978805ddd907d7fd1b9038e6ccb3cb7d3fdd9314650ed74e

    • SHA512

      40faf976a977fd67d7d3024b1caafeb34d0245b24096c0400bcd7ae86bb7f761849e097cdb177c2fbaa7457503b7b704d89a29053d164371e7e396e1683535b7

    • SSDEEP

      1536:iRvLphwAO2PH1srwmJmRqJ4P4tHrtxorO23ZWoPPvNdq4zFisCaR:ilpOI2wmJmRqJ/12JWKPFdqsi1E

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral7behavioral8

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      06bef96b91bfa75b7f7817341a6cd597

    • SHA1

      48a40368fc339ccea1dfda06d2e02bca7d7265c1

    • SHA256

      2ca5590c85cc31285b83bbe569755d909d91b559db2d6ce3bca2fcc075225364

    • SHA512

      5364d0944b4be215fb5d8bb8398e965ff6fa3190a962dd6c491984482321756017f89c2242d77ebcce6666c31fe54a956f2eb3a03a95d64121a1db462ad20a0d

    • SSDEEP

      192:Q6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTtK72dwF7dBdcQOz:Q6JaVh4I5rpPbTt+BdhO

    Score
    3/10
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      f0e51d5722c11a4fe40c97b746c1ffc5

    • SHA1

      8ec31853e9ef08fdc2a8c3c8eaa5f5b9469af193

    • SHA256

      93a27f96055ae6b7f44916e13487b0efa7cd6d762e6768f7cb6427e32bda777d

    • SHA512

      212c1ed753b54e5eccf7e1421bcca86955e09d6e3873f891d3d7076e21f79feb5f1dba350818804a215980875c306283b02f628fbc191d958f0de0f528c7194a

    • SSDEEP

      192:94lsN55M8r67wmsvJI5a299sfoG8I+WhPB3RY+h/G3DNl/qYcVp/12/gszA:9ysdM80dCI5a2LsQ5IlPNRY00AlAxU

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/Processes.dll

    • Size

      35KB

    • MD5

      2cfba79d485cf441c646dd40d82490fc

    • SHA1

      83e51ac1115a50986ed456bd18729653018b9619

    • SHA256

      86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7

    • SHA512

      cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043

    • SSDEEP

      768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/System.dll

    • Size

      10KB

    • MD5

      7e3c808299aa2c405dffa864471ddb7f

    • SHA1

      b5de7804dd35ed7afd0c3b59d866f1a0749495e0

    • SHA256

      91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd

    • SHA512

      599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738

    • SSDEEP

      192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw

    Score
    3/10
    behavioral15behavioral16

    • Target

      $SYSDIR/$SYSDIR/$_8_.dll

    • Size

      186KB

    • MD5

      01b0a06783e1e96fef5ce32966e0e48c

    • SHA1

      c61ed5bec7b8b574831973d242fb91b2775f06ab

    • SHA256

      d9230befe6ba2faa7f6902abf1a13df5b754fa2776706e981ed0caf3dab63705

    • SHA512

      e41838426c0890590664995e51356c6abea843a98ef5a7ef172ebb666e9cfe8ba2a3e5b030780390563cee60273f0ddc8466a8815be1d38b33eb9d8f16326c2a

    • SSDEEP

      3072:nEJrn0vey3BbGGI/gK6lO6VuQvL5vKry7ZbKYjO38byySak5Vjz:KrnueyEGIApVuHbYj8hawj

    Score
    6/10
    adwarepersistencestealer

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral17behavioral18

MITRE ATT&CK Enterprise v15

Tasks