c801796057378ce71ed1f3340011b666928d797e46a36a5bf71a9d732fc55925 | Triage

Sharing

General

Target

7edfe677a3c7d6c196fb61882bd07320N.exe
Size

855KB
Sample

240716-gx786a1elc
MD5

7edfe677a3c7d6c196fb61882bd07320
SHA1

9c50a2c2ae16b3251689f57afabc7831bfb0c300
SHA256

c801796057378ce71ed1f3340011b666928d797e46a36a5bf71a9d732fc55925
SHA512

9d79a7c4a0bdf88616839c270e1417c49288137cf26466c17a2a533e49360366e8fa6e77ba021e405bd9ad311470fd232244e67d468d8e4c9d8fcb516b1b27f8
SSDEEP

12288:dXCNi9BJGabBgRpSTiS8t8w+LIn/98xkQCFMvY6e12s+ABZK03pXnP42gBxzXeVI:oWl9T38yy8eie12sLZDf4RxyV23VO1Xs

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  7edfe677a3c7d6c196fb61882bd07320N.exe
- Size
  
  855KB
- MD5
  
  7edfe677a3c7d6c196fb61882bd07320
- SHA1
  
  9c50a2c2ae16b3251689f57afabc7831bfb0c300
- SHA256
  
  c801796057378ce71ed1f3340011b666928d797e46a36a5bf71a9d732fc55925
- SHA512
  
  9d79a7c4a0bdf88616839c270e1417c49288137cf26466c17a2a533e49360366e8fa6e77ba021e405bd9ad311470fd232244e67d468d8e4c9d8fcb516b1b27f8
- SSDEEP
  
  12288:dXCNi9BJGabBgRpSTiS8t8w+LIn/98xkQCFMvY6e12s+ABZK03pXnP42gBxzXeVI:oWl9T38yy8eie12sLZDf4RxyV23VO1Xs
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer