Overview

overview

10

Static

static

10

c387c62459...3d.exe

windows7-x64

9

c387c62459...3d.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    c387c624596772a1b531cc19f3c542d3699a4e5055a2de7c28e2204c7d11203d

  • Size

    226KB

  • Sample

    240628-cs17tsyemn

  • MD5

    fd5854afbaab2e4603b90a76e2bcc91e

  • SHA1

    aa91948e42235a04eeee58ceb59e54b5a417095d

  • SHA256

    c387c624596772a1b531cc19f3c542d3699a4e5055a2de7c28e2204c7d11203d

  • SHA512

    26d7599e44bfff159e40cfed170802a6e228a41ba22fadf6382c4098946a423a6d8826c696cd79180c60033e6776d7b01d1046071f748e830529b797995bdddb

  • SSDEEP

    6144:dXC4vgmhbIxs3NBBD0h63O7hvm5GQWZhMi1mgqiQLa9A:dXCNi9BW8mmAQWZh71mZLCA

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      c387c624596772a1b531cc19f3c542d3699a4e5055a2de7c28e2204c7d11203d

    • Size

      226KB

    • MD5

      fd5854afbaab2e4603b90a76e2bcc91e

    • SHA1

      aa91948e42235a04eeee58ceb59e54b5a417095d

    • SHA256

      c387c624596772a1b531cc19f3c542d3699a4e5055a2de7c28e2204c7d11203d

    • SHA512

      26d7599e44bfff159e40cfed170802a6e228a41ba22fadf6382c4098946a423a6d8826c696cd79180c60033e6776d7b01d1046071f748e830529b797995bdddb

    • SSDEEP

      6144:dXC4vgmhbIxs3NBBD0h63O7hvm5GQWZhMi1mgqiQLa9A:dXCNi9BW8mmAQWZh71mZLCA

    Score
    9/10
    persistencespywarestealer

    • Detects executables containing possible sandbox analysis VM usernames

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks