Overview

overview

8

Static

static

3

e0258ce3b3...f1.exe

windows7-x64

8

e0258ce3b3...f1.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16804479640.zip

  • Size

    3.5MB

  • Sample

    240422-3axd2ahf5y

  • MD5

    8823767a38be69c69888fc14fc202daa

  • SHA1

    b8b759e8cdb6d3b843758680c21f03b5fd2de034

  • SHA256

    59deca31b551d4f4f5dde9d10162798071f955a9351d0aa7e4a0a3b3a637eff6

  • SHA512

    dec02344e9941986d7a9d7edd60831ed38aee2ca14c88a6d23a35f9a0e9f978697cfb7b3fa3b98ae500a296d37b7aacc936edd6b6db9507e645e1248186e147c

  • SSDEEP

    98304:FklChg4S5B23/5oeBmosI66ecnGbF1y/T/E7cTa:qlthG/5oPtIXecGS/T/ja

Score
8/10
discoveryexploitpersistencespywarestealerupx

Malware Config

Targets

    • Target

      e0258ce3b3c7b050acf6cc35d6fe6c08b2bf347b811b2de17e5cd205d411eaf1

    • Size

      3.5MB

    • MD5

      f73825b9aba318f58fcfeac0aa4301e7

    • SHA1

      0792d79fc8698384f38bda1aae1bb8c50ccbabef

    • SHA256

      e0258ce3b3c7b050acf6cc35d6fe6c08b2bf347b811b2de17e5cd205d411eaf1

    • SHA512

      3a167e852b6542088920fec0f1c2786cfdfaf17518b52328e708e605a40223f7e81ceee7f94aa9165fbba2cfc764892a3f9c2d98303c12ca2780062a1214e5a4

    • SSDEEP

      98304:wYVrGDK0+E6l4LKGoJmNriyvudK1YOSAmurDmMtT+1:wI0KlUMwbviK1gAmImki

    Score
    8/10
    discoveryexploitpersistencespywarestealerupx

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

      exploit

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks