9d972130e4e727917ed704d06666e79f6b91d98b78e4e1f69e7e96983afdc1bc | Triage

Sharing

General

Target

e512c5dc235910cef92fda8cb68be310N.exe
Size

780KB
Sample

240721-ten4savdpa
MD5

e512c5dc235910cef92fda8cb68be310
SHA1

2324aa0e5900ece3ebc133f7c5fafb2b641026b0
SHA256

9d972130e4e727917ed704d06666e79f6b91d98b78e4e1f69e7e96983afdc1bc
SHA512

76e332d4d98122948e231a8437dcd41e2994d0dbde1a7e7c1677b18130fdc5d8e17a994454bc149dc1525bbe30e5ca81ee201f9a290f77bce360800db991868d
SSDEEP

12288:JXCNi9BTWLskzcBISneW1cX0pCHKYXfWvG378M3VWuGZu8OOPdl4GMbUej:sWTAopnH1ckcdbV3AuTMdlmX

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  e512c5dc235910cef92fda8cb68be310N.exe
- Size
  
  780KB
- MD5
  
  e512c5dc235910cef92fda8cb68be310
- SHA1
  
  2324aa0e5900ece3ebc133f7c5fafb2b641026b0
- SHA256
  
  9d972130e4e727917ed704d06666e79f6b91d98b78e4e1f69e7e96983afdc1bc
- SHA512
  
  76e332d4d98122948e231a8437dcd41e2994d0dbde1a7e7c1677b18130fdc5d8e17a994454bc149dc1525bbe30e5ca81ee201f9a290f77bce360800db991868d
- SSDEEP
  
  12288:JXCNi9BTWLskzcBISneW1cX0pCHKYXfWvG378M3VWuGZu8OOPdl4GMbUej:sWTAopnH1ckcdbV3AuTMdlmX
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer