744748e93af9462359490c1982181f838ba70332cb9deb6f3635d5b69d13dad8 | Triage

Sharing

General

Target

2024-04-28_ec1f6305e06564efb9b8552327f8eed2_bkransomware
Size

28.0MB
Sample

240428-xp1r4seh5w
MD5

ec1f6305e06564efb9b8552327f8eed2
SHA1

422d90377a959278be55158f42fdaec16af925db
SHA256

744748e93af9462359490c1982181f838ba70332cb9deb6f3635d5b69d13dad8
SHA512

ed5e580e733bcd858ec54c0e63d6836c6e1415717f50c720b9567c55f9494b52c4daaffc64428d20a4c525be5725930dba51a7cc3f044cd37aef24c68bbe288d
SSDEEP

786432:mNSx9bbKv4/4Ezdsh/Z+m+OWGWIuoaMheuY3gmq11t:mNSx1Kv4AEpU/Zporo0ux3D

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-04-28_ec1f6305e06564efb9b8552327f8eed2_bkransomware
- Size
  
  28.0MB
- MD5
  
  ec1f6305e06564efb9b8552327f8eed2
- SHA1
  
  422d90377a959278be55158f42fdaec16af925db
- SHA256
  
  744748e93af9462359490c1982181f838ba70332cb9deb6f3635d5b69d13dad8
- SHA512
  
  ed5e580e733bcd858ec54c0e63d6836c6e1415717f50c720b9567c55f9494b52c4daaffc64428d20a4c525be5725930dba51a7cc3f044cd37aef24c68bbe288d
- SSDEEP
  
  786432:mNSx9bbKv4/4Ezdsh/Z+m+OWGWIuoaMheuY3gmq11t:mNSx1Kv4AEpU/Zporo0ux3D
Score

7^/10

persistence spyware stealer discovery
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

discoverypersistencespywarestealer