67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284 | Triage

Submit
Reports

Overview

overview

Static

static

67c4ba482b...84.exe

windows7-x64

9

67c4ba482b...84.exe

windows10-2004-x64

9

Sharing

General

Target

67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284
Size

1.7MB
Sample

240422-2zqr4she4v
MD5

4b0d67c0e794f4e29f7e54e8778ad963
SHA1

943c6f06939e46a8377785405f2035d47437a260
SHA256

67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284
SHA512

b481c108f218020c5df44b0f9d6dc195b5a87517d2c6cb73ff6941ac701c4adc8b2c6355722f522c0c6f70dcd157e72bcd190ee174182194b425f443bc583f2d
SSDEEP

49152:RXNTawxaOITMIHj/wiKRKR4NM3UgoAebS:RXNaMIHs9RKR4K3UieW

Score

10^/10

persistence spyware stealer

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284.exe

Resource

win7-20240220-en

persistence spyware stealer

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284.exe

Resource

win10v2004-20240412-en

persistence spyware stealer

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284
- Size
  
  1.7MB
- MD5
  
  4b0d67c0e794f4e29f7e54e8778ad963
- SHA1
  
  943c6f06939e46a8377785405f2035d47437a260
- SHA256
  
  67c4ba482bc978c2a7f7fd4febde24749ab9961004ebebb8f2f798c1783af284
- SHA512
  
  b481c108f218020c5df44b0f9d6dc195b5a87517d2c6cb73ff6941ac701c4adc8b2c6355722f522c0c6f70dcd157e72bcd190ee174182194b425f443bc583f2d
- SSDEEP
  
  49152:RXNTawxaOITMIHj/wiKRKR4NM3UgoAebS:RXNaMIHs9RKR4K3UieW
Score

9^/10

persistence spyware stealer
- Detects executables containing possible sandbox analysis VM usernames
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer

© 2018-2024

Terms | Privacy