c1edc04c169b03c97a8c5d9b1bcf9f044e7b002ff54af2fc0537ee6cb2640c0d | Triage

Sharing

General

Target

c1edc04c169b03c97a8c5d9b1bcf9f044e7b002ff54af2fc0537ee6cb2640c0d
Size

5.7MB
Sample

240523-mcswmada2v
MD5

be7c4db7d10b390cc45e858b416213aa
SHA1

b3663016be9150ec9f731ea8eeed587a223bcf62
SHA256

c1edc04c169b03c97a8c5d9b1bcf9f044e7b002ff54af2fc0537ee6cb2640c0d
SHA512

dd30dfeb1d48fa029a9cbd071704667666be9d9d989875baaaa48f0e76d1c07b4a5927bfc2720839adc4ccac83dc42878696cb8962500bef8691355eeee3c2f1
SSDEEP

49152:OB7Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTP:OtKUgTH2M2m9UMpu1QfLczqssnKSk

Score

7^/10

spyware stealer

Malware Config

Targets

- Target
  
  c1edc04c169b03c97a8c5d9b1bcf9f044e7b002ff54af2fc0537ee6cb2640c0d
- Size
  
  5.7MB
- MD5
  
  be7c4db7d10b390cc45e858b416213aa
- SHA1
  
  b3663016be9150ec9f731ea8eeed587a223bcf62
- SHA256
  
  c1edc04c169b03c97a8c5d9b1bcf9f044e7b002ff54af2fc0537ee6cb2640c0d
- SHA512
  
  dd30dfeb1d48fa029a9cbd071704667666be9d9d989875baaaa48f0e76d1c07b4a5927bfc2720839adc4ccac83dc42878696cb8962500bef8691355eeee3c2f1
- SSDEEP
  
  49152:OB7Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTP:OtKUgTH2M2m9UMpu1QfLczqssnKSk
Score

7^/10

spyware stealer
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2