Overview

overview

10

Static

static

10

029e0e1b6f...51.exe

windows7-x64

9

029e0e1b6f...51.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    029e0e1b6fc5a1194a438f4d83b22e9fb0d2eb602787ce8f6f9e123c747f7251

  • Size

    1.1MB

  • Sample

    240421-wsq7eagf25

  • MD5

    a37320b10d53f6ea796a474076266bfe

  • SHA1

    155241d2a0eb62584c63cfb4e9a9b7c2cca71715

  • SHA256

    029e0e1b6fc5a1194a438f4d83b22e9fb0d2eb602787ce8f6f9e123c747f7251

  • SHA512

    e0e17ce383b776451652404c912c8159491697f7231df9e1d2db7d10ac9919c1f0b16bda0aed5beee0466e033ebe3ebf02c2310c11a40ccc47d1a330ce219bce

  • SSDEEP

    24576:lq89j5NkKyCCO7k2MJDAPvkxOH2WuJ9DJpXdchvWodH473tK8vaau4g+lNc:F5NkKytO7k2MJ8PoOH2lr9ptCo9Ke9gx

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      029e0e1b6fc5a1194a438f4d83b22e9fb0d2eb602787ce8f6f9e123c747f7251

    • Size

      1.1MB

    • MD5

      a37320b10d53f6ea796a474076266bfe

    • SHA1

      155241d2a0eb62584c63cfb4e9a9b7c2cca71715

    • SHA256

      029e0e1b6fc5a1194a438f4d83b22e9fb0d2eb602787ce8f6f9e123c747f7251

    • SHA512

      e0e17ce383b776451652404c912c8159491697f7231df9e1d2db7d10ac9919c1f0b16bda0aed5beee0466e033ebe3ebf02c2310c11a40ccc47d1a330ce219bce

    • SSDEEP

      24576:lq89j5NkKyCCO7k2MJDAPvkxOH2WuJ9DJpXdchvWodH473tK8vaau4g+lNc:F5NkKytO7k2MJ8PoOH2lr9ptCo9Ke9gx

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks