c47ae427dc9ae9c8f5d9bcd19c02da056c550d9e876fcc8dbd907758719612ce | Triage

Sharing

General

Target

6c01855d913b0c19e2565463ae1ac790N.exe
Size

1.3MB
Sample

240720-j14fgsxdje
MD5

6c01855d913b0c19e2565463ae1ac790
SHA1

6252f1a24d05a94c54a695d0d226e2c8d8cb35ba
SHA256

c47ae427dc9ae9c8f5d9bcd19c02da056c550d9e876fcc8dbd907758719612ce
SHA512

f3bb7de6055ee7716db188792cdf02363cc75fea1d3efafc79d3d77d040226da7450c378eaa5829209ab4e43da24548157ef76939eea9d9a2edc28e30d207131
SSDEEP

24576:oWVJDnpTGUJUUHxFlPPipv1nXHVOAp25Gwlu7kA0MWmkdl4gyuC2nULL7WyjZ/:V7jhJ3lK1nXIAp2kwlu7kA0wKl4gzC28

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  6c01855d913b0c19e2565463ae1ac790N.exe
- Size
  
  1.3MB
- MD5
  
  6c01855d913b0c19e2565463ae1ac790
- SHA1
  
  6252f1a24d05a94c54a695d0d226e2c8d8cb35ba
- SHA256
  
  c47ae427dc9ae9c8f5d9bcd19c02da056c550d9e876fcc8dbd907758719612ce
- SHA512
  
  f3bb7de6055ee7716db188792cdf02363cc75fea1d3efafc79d3d77d040226da7450c378eaa5829209ab4e43da24548157ef76939eea9d9a2edc28e30d207131
- SSDEEP
  
  24576:oWVJDnpTGUJUUHxFlPPipv1nXHVOAp25Gwlu7kA0MWmkdl4gyuC2nULL7WyjZ/:V7jhJ3lK1nXIAp2kwlu7kA0wKl4gzC28
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer