Overview

overview

10

Static

static

1

9bd8be1ddf...a7.exe

windows7-x64

10

9bd8be1ddf...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9bd8be1ddf1c3847995b0659911a6d5dba351504a2f752c0f4a8ae7d4b17b9a7

  • Size

    3.5MB

  • Sample

    240630-alrzgatdrn

  • MD5

    9cc535dd1c20ebb196f2638f694bd77a

  • SHA1

    ba8e1e934420c67547a68052d29bb5766c4c0b2e

  • SHA256

    9bd8be1ddf1c3847995b0659911a6d5dba351504a2f752c0f4a8ae7d4b17b9a7

  • SHA512

    8f83de7aaccd97da7d42b5f644c884d6a2c3eb9e69c4552b256d360307bb7c5bfc9ea95acd57c92ce6d161f16152d1fe3d3a64420bc4db41582c81d36c09c4a0

  • SSDEEP

    49152:cP5r8oHl3obnWR1jdak2+8LIDITWHfwkbtKCL6asof1RABJAGdZY6+FK+HGJ2:cP5SbMkTs0TlkjeWDAB9ZY6+FKD2

Score
10/10
persistencespywarestealer

Malware Config

Targets

    • Target

      9bd8be1ddf1c3847995b0659911a6d5dba351504a2f752c0f4a8ae7d4b17b9a7

    • Size

      3.5MB

    • MD5

      9cc535dd1c20ebb196f2638f694bd77a

    • SHA1

      ba8e1e934420c67547a68052d29bb5766c4c0b2e

    • SHA256

      9bd8be1ddf1c3847995b0659911a6d5dba351504a2f752c0f4a8ae7d4b17b9a7

    • SHA512

      8f83de7aaccd97da7d42b5f644c884d6a2c3eb9e69c4552b256d360307bb7c5bfc9ea95acd57c92ce6d161f16152d1fe3d3a64420bc4db41582c81d36c09c4a0

    • SSDEEP

      49152:cP5r8oHl3obnWR1jdak2+8LIDITWHfwkbtKCL6asof1RABJAGdZY6+FK+HGJ2:cP5SbMkTs0TlkjeWDAB9ZY6+FKD2

    Score
    10/10
    persistencespywarestealer

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Detects executables containing bas64 encoded gzip files

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

2
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks