Overview

overview

8

Static

static

3

1.exe

windows7-x64

8

1.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1.exe

  • Size

    20.2MB

  • Sample

    240708-kd5wga1bmk

  • MD5

    1ec230f49105824bb12fd8574bf1084b

  • SHA1

    e8becc96b64fd80d23ae83e63d9b7c7f5f2e4954

  • SHA256

    cd642c7b2e6fd20593593e89113988f0a5af0157c5d6f46312d9c51ab25276f7

  • SHA512

    115af5050c11834f87ff41543fc3ac916af02964867144e28de5c9e890921d21dc34bd77f61cda5319d7f58151a520374e72fd8ff558ef34f6027719b06129b1

  • SSDEEP

    393216:SbHD/J/Jsv6tWKFdu9CkxqfgMJZzA6C3cL+4uWI0rK8KMlH0gieD:MkwLAk

Score
8/10
persistencespywarestealer

Malware Config

Targets

    • Target

      1.exe

    • Size

      20.2MB

    • MD5

      1ec230f49105824bb12fd8574bf1084b

    • SHA1

      e8becc96b64fd80d23ae83e63d9b7c7f5f2e4954

    • SHA256

      cd642c7b2e6fd20593593e89113988f0a5af0157c5d6f46312d9c51ab25276f7

    • SHA512

      115af5050c11834f87ff41543fc3ac916af02964867144e28de5c9e890921d21dc34bd77f61cda5319d7f58151a520374e72fd8ff558ef34f6027719b06129b1

    • SSDEEP

      393216:SbHD/J/Jsv6tWKFdu9CkxqfgMJZzA6C3cL+4uWI0rK8KMlH0gieD:MkwLAk

    Score
    8/10
    spywarestealerpersistence

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Modifies termsrv.dll

      Commonly used to allow simultaneous RDP sessions.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks