Overview

overview

10

Static

static

3

x4hostTesT.exe

windows7-x64

10

x4hostTesT.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    x4hostTesT.exe

  • Size

    748KB

  • Sample

    240715-k2a11a1gkc

  • MD5

    41c2809934950af9e2634aa54cbffe17

  • SHA1

    680229680df803f57b469f1131523405bc69682e

  • SHA256

    b4d7cdcabead94586770c0a211fe3083419ae2856422bade3e5e2d30611e5660

  • SHA512

    72c38ce481db3f2cb97e34247a2e556f80e5b0d2a48d5c83b9138cb1ce2b81f09425a1537fd52adacf4de67b46ccb24433d76fe5f3145e6fd12151164dbd3cc9

  • SSDEEP

    12288:Fmj33G0OKtrxdx6TOVVPatXNFiRuOSBXWfIA6xlca+Wx5Ru7xC7Jm3wkCbK2m1XO:AjG0OKtrYTcitoBSwfITxearx55JmAZL

Score
10/10
spywarestealer

Malware Config

Targets

    • Target

      x4hostTesT.exe

    • Size

      748KB

    • MD5

      41c2809934950af9e2634aa54cbffe17

    • SHA1

      680229680df803f57b469f1131523405bc69682e

    • SHA256

      b4d7cdcabead94586770c0a211fe3083419ae2856422bade3e5e2d30611e5660

    • SHA512

      72c38ce481db3f2cb97e34247a2e556f80e5b0d2a48d5c83b9138cb1ce2b81f09425a1537fd52adacf4de67b46ccb24433d76fe5f3145e6fd12151164dbd3cc9

    • SSDEEP

      12288:Fmj33G0OKtrxdx6TOVVPatXNFiRuOSBXWfIA6xlca+Wx5Ru7xC7Jm3wkCbK2m1XO:AjG0OKtrYTcitoBSwfITxearx55JmAZL

    Score
    10/10
    spywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks