Overview

overview

7

Static

static

3

svchost.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    5.3MB

  • Sample

    240526-qewbbagb94

  • MD5

    fcd43ec0e853fdc49804259d9e0d1cf8

  • SHA1

    9e31403b4be7b991961fc2c85aeb3b72f1aab23d

  • SHA256

    c914eed114c9b2ee359c2e7d6783d79658c7fa65fbba815e55e94fe945093410

  • SHA512

    a558888493bddd9e0679693bda114965c721d77a7dec2f95673c430ecc6ecb2a56c9ca681bc38977ee37218585551f850bf5e256e4fb29c3a982031b88c69f60

  • SSDEEP

    98304:0p3J4X3IT06wWXuycm/iAGqgXuaLq5vA1pYAWBcrKFrSznSn60siIcnauJKa:0tKWYbycm/iAvgXuQ8vCYIeSB0s6auka

Score
7/10
pyinstallerspywarestealer

Malware Config

Targets

    • Target

      svchost.exe

    • Size

      5.3MB

    • MD5

      fcd43ec0e853fdc49804259d9e0d1cf8

    • SHA1

      9e31403b4be7b991961fc2c85aeb3b72f1aab23d

    • SHA256

      c914eed114c9b2ee359c2e7d6783d79658c7fa65fbba815e55e94fe945093410

    • SHA512

      a558888493bddd9e0679693bda114965c721d77a7dec2f95673c430ecc6ecb2a56c9ca681bc38977ee37218585551f850bf5e256e4fb29c3a982031b88c69f60

    • SSDEEP

      98304:0p3J4X3IT06wWXuycm/iAGqgXuaLq5vA1pYAWBcrKFrSznSn60siIcnauJKa:0tKWYbycm/iAvgXuQ8vCYIeSB0s6auka

    Score
    7/10
    spywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks