298220726a33e54d2ea3726c815b162714dc0700fb34ee14ba4f640243d58fb8 | Triage

Sharing

General

Target

298220726a33e54d2ea3726c815b162714dc0700fb34ee14ba4f640243d58fb8.exe
Size

895KB
Sample

240705-cbnkeazcmq
MD5

87121f3a5ff886446bf496b1a54d0bb0
SHA1

ae4e88250d29909ffa0cdbaa4425d17aa3895d52
SHA256

298220726a33e54d2ea3726c815b162714dc0700fb34ee14ba4f640243d58fb8
SHA512

ebd5d8f35f68c02161223e17003a6158e81bfdaa19873da4c9466766efd53d0132527c9467b94b05b3b071f649215205475779317da888c00530ab41b48d00e8
SSDEEP

24576:2wsKuU3hsn3oetSz31nq4AzqysGM1OUBI9I63aXh:hs8hsn4et6304A2ysDkB9Iwsh

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  298220726a33e54d2ea3726c815b162714dc0700fb34ee14ba4f640243d58fb8.exe
- Size
  
  895KB
- MD5
  
  87121f3a5ff886446bf496b1a54d0bb0
- SHA1
  
  ae4e88250d29909ffa0cdbaa4425d17aa3895d52
- SHA256
  
  298220726a33e54d2ea3726c815b162714dc0700fb34ee14ba4f640243d58fb8
- SHA512
  
  ebd5d8f35f68c02161223e17003a6158e81bfdaa19873da4c9466766efd53d0132527c9467b94b05b3b071f649215205475779317da888c00530ab41b48d00e8
- SSDEEP
  
  24576:2wsKuU3hsn3oetSz31nq4AzqysGM1OUBI9I63aXh:hs8hsn4et6304A2ysDkB9Iwsh
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer