859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553 | Triage

Submit
Reports

Overview

overview

8

Static

static

3

859dda7c86...53.exe

windows7-x64

8

859dda7c86...53.exe

windows10-2004-x64

8

Sharing

General

Target

859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553
Size

2.6MB
Sample

240524-r2gbcahg66
MD5

50d23837a69f9604c1b77771fb3c4311
SHA1

a93a3ba1d884001bc567ccbe5ec38e1db8ae4996
SHA256

859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553
SHA512

d66a5125c3c49267635e0e691f5c5aa450a8070ccccbb93a195651518e07c65a71f625b64ae9891fdfaba78218c445d43a7b6cbe1674babad953b1db2c58df52
SSDEEP

24576:+A8vyrepIND/0bfSPdaY1RFo3UR+h+8fEvdDrGnrdEROGHOhBBoKpYC/hRJHOh:+A81IJPRqnEvdDqnroHOPHO

Score

8^/10

discovery spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553.exe

Resource

win7-20240215-en

discovery spyware stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553.exe

Resource

win10v2004-20240508-en

discovery spyware stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553
- Size
  
  2.6MB
- MD5
  
  50d23837a69f9604c1b77771fb3c4311
- SHA1
  
  a93a3ba1d884001bc567ccbe5ec38e1db8ae4996
- SHA256
  
  859dda7c86dd317344da7f5b0c74125c74db0fd943873b9689673de2f7773553
- SHA512
  
  d66a5125c3c49267635e0e691f5c5aa450a8070ccccbb93a195651518e07c65a71f625b64ae9891fdfaba78218c445d43a7b6cbe1674babad953b1db2c58df52
- SSDEEP
  
  24576:+A8vyrepIND/0bfSPdaY1RFo3UR+h+8fEvdDrGnrdEROGHOhBBoKpYC/hRJHOh:+A81IJPRqnEvdDqnroHOPHO
Score

8^/10

discovery spyware stealer
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspywarestealer

behavioral2

discoveryspywarestealer

© 2018-2024

Terms | Privacy