67b19e3b641fc17f4d751a4c81c2461215e51513580f72d4c3fc9e17b623293b | Triage

Sharing

General

Target

6802938ccf10ea9b804bb2d7b8a65048.exe
Size

1.1MB
Sample

240502-nnrndaaa89
MD5

6802938ccf10ea9b804bb2d7b8a65048
SHA1

8bdf939d410e197cc97b4125df674d63baae50fe
SHA256

67b19e3b641fc17f4d751a4c81c2461215e51513580f72d4c3fc9e17b623293b
SHA512

1035bd222d77b4a60442aa0147fc658e0cd77c51c8db533a19c96141fd09f492ca1a3a80a78ea6b2f2e22d1a0b4b60d268630622d74dc7f3044175b560f849fe
SSDEEP

24576:lq8OLfvniBfba2rZmLKs+it8EUBqNTLgOiw0GFPw1/m22IOYUB9Nm:Wrnixb/Vmmnit8lUYOiB9VrEYm9Nm

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  6802938ccf10ea9b804bb2d7b8a65048.exe
- Size
  
  1.1MB
- MD5
  
  6802938ccf10ea9b804bb2d7b8a65048
- SHA1
  
  8bdf939d410e197cc97b4125df674d63baae50fe
- SHA256
  
  67b19e3b641fc17f4d751a4c81c2461215e51513580f72d4c3fc9e17b623293b
- SHA512
  
  1035bd222d77b4a60442aa0147fc658e0cd77c51c8db533a19c96141fd09f492ca1a3a80a78ea6b2f2e22d1a0b4b60d268630622d74dc7f3044175b560f849fe
- SSDEEP
  
  24576:lq8OLfvniBfba2rZmLKs+it8EUBqNTLgOiw0GFPw1/m22IOYUB9Nm:Wrnixb/Vmmnit8lUYOiB9VrEYm9Nm
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer