Overview

overview

10

Static

static

10

8845e2078c...d8.exe

windows7-x64

9

8845e2078c...d8.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8845e2078c6fadf42e19e2a8f75390d86967ed08ffd94b80f218df5f1b8aa8d8

  • Size

    91KB

  • Sample

    240419-3xbe3sbf6v

  • MD5

    45bdf43bb8d23ba903968f2377589ab5

  • SHA1

    4d173c0a50f7cefd6377701d1d2aaad8392f7cd7

  • SHA256

    8845e2078c6fadf42e19e2a8f75390d86967ed08ffd94b80f218df5f1b8aa8d8

  • SHA512

    8f9a173e8d149f1ae83765b6f4a6916159105b69a0982976528b7bdcc1e476f74572622dff5c7da8598208eb80ebf59c031f49a7693d69f9a7741ed197067680

  • SSDEEP

    1536:N5VzcfA/6LrVpL74gfh16nxlzEnE0rAguD0Ob319nn6igyJBhCIMXCFqHyjIgB8H:/V2A/gVh74gpgLEngbz19n6JIuC8H9gU

Score
10/10
persistencespywarestealerupx

Malware Config

Targets

    • Target

      8845e2078c6fadf42e19e2a8f75390d86967ed08ffd94b80f218df5f1b8aa8d8

    • Size

      91KB

    • MD5

      45bdf43bb8d23ba903968f2377589ab5

    • SHA1

      4d173c0a50f7cefd6377701d1d2aaad8392f7cd7

    • SHA256

      8845e2078c6fadf42e19e2a8f75390d86967ed08ffd94b80f218df5f1b8aa8d8

    • SHA512

      8f9a173e8d149f1ae83765b6f4a6916159105b69a0982976528b7bdcc1e476f74572622dff5c7da8598208eb80ebf59c031f49a7693d69f9a7741ed197067680

    • SSDEEP

      1536:N5VzcfA/6LrVpL74gfh16nxlzEnE0rAguD0Ob319nn6igyJBhCIMXCFqHyjIgB8H:/V2A/gVh74gpgLEngbz19n6JIuC8H9gU

    Score
    9/10
    persistencespywarestealerupx

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks