826ce34e39da7cc907325f060281a009c121ffd2def2c704d905bbf5e758c9c2 | Triage

Sharing

General

Target

21eebde62ef87184d6d09586b9567510.exe
Size

696KB
Sample

240706-a17cpstaja
MD5

21eebde62ef87184d6d09586b9567510
SHA1

e7fe55345e940b3ce7d6da65daedff0ae2fd4bfa
SHA256

826ce34e39da7cc907325f060281a009c121ffd2def2c704d905bbf5e758c9c2
SHA512

64170ca8932bd23449bf8b2b1732649d6bfb0a700940ee2a698275698654d94b738c25b0cd61d8d6901b7dad56ae765a3bc3726549e836ff873663a5d4d40b7c
SSDEEP

12288:dXCNi9BxB8iBd5xSu0OlahESYDnzHX115hurQPcUMjdQna11bVhbJ:oWL8Q5T0xmSYDBEEmj4I9

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  21eebde62ef87184d6d09586b9567510.exe
- Size
  
  696KB
- MD5
  
  21eebde62ef87184d6d09586b9567510
- SHA1
  
  e7fe55345e940b3ce7d6da65daedff0ae2fd4bfa
- SHA256
  
  826ce34e39da7cc907325f060281a009c121ffd2def2c704d905bbf5e758c9c2
- SHA512
  
  64170ca8932bd23449bf8b2b1732649d6bfb0a700940ee2a698275698654d94b738c25b0cd61d8d6901b7dad56ae765a3bc3726549e836ff873663a5d4d40b7c
- SSDEEP
  
  12288:dXCNi9BxB8iBd5xSu0OlahESYDnzHX115hurQPcUMjdQna11bVhbJ:oWL8Q5T0xmSYDBEEmj4I9
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer