11e69407dca5b115dc44aaab7cf9e9ca19177985d1db1d22931e114b7ddb0948 | Triage

Sharing

General

Target

11e69407dca5b115dc44aaab7cf9e9ca19177985d1db1d22931e114b7ddb0948
Size

141KB
Sample

240428-rkdh5ahd87
MD5

23b8184d2293bedae5b2062c3cb40112
SHA1

20ed7dca7d6070cce19d4fa1b338c72cc313e18a
SHA256

11e69407dca5b115dc44aaab7cf9e9ca19177985d1db1d22931e114b7ddb0948
SHA512

e4cbf6cd97141d9218e59dd806c91ba2ac799b3d9188d2f2187400fc6f393da2a20668e09bfc6ee7e318670e6762ea63bc549cdfc782826f09336c6a80ec3795
SSDEEP

3072:/3e+a+3dN5asRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:m+aM3YHKreQ32hlBG

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  11e69407dca5b115dc44aaab7cf9e9ca19177985d1db1d22931e114b7ddb0948
- Size
  
  141KB
- MD5
  
  23b8184d2293bedae5b2062c3cb40112
- SHA1
  
  20ed7dca7d6070cce19d4fa1b338c72cc313e18a
- SHA256
  
  11e69407dca5b115dc44aaab7cf9e9ca19177985d1db1d22931e114b7ddb0948
- SHA512
  
  e4cbf6cd97141d9218e59dd806c91ba2ac799b3d9188d2f2187400fc6f393da2a20668e09bfc6ee7e318670e6762ea63bc549cdfc782826f09336c6a80ec3795
- SSDEEP
  
  3072:/3e+a+3dN5asRYHKreCC0XUq2yiqzv6z4AXrB4APHCv:m+aM3YHKreQ32hlBG
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2