04f380864eb0622e58f6fa9b6e5acc93ae8c3eaeb0a8086ad15e3aac2d6484c0 | Triage

Sharing

General

Target

a10a2f30b42e4f1fc61f81e054746110N.exe
Size

542KB
Sample

240722-mxd8zatcmh
MD5

a10a2f30b42e4f1fc61f81e054746110
SHA1

e083f3dcc54254c0fe0de5ddb1dd16b8dfd9b56f
SHA256

04f380864eb0622e58f6fa9b6e5acc93ae8c3eaeb0a8086ad15e3aac2d6484c0
SHA512

8ec5720c9e486fe5a52b89e84bd5c653e2f99032a19576baed0b1352fd0c84212e7410bdf56c8214c70238cc9928851eada635b063c9a17a654941fdb1456dd6
SSDEEP

12288:oGHasii9BiREnNRo2WVIngoh+11cJtumyCP6q1r8YRI06y/:86iRENerC+11ciVqCYRQc

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  a10a2f30b42e4f1fc61f81e054746110N.exe
- Size
  
  542KB
- MD5
  
  a10a2f30b42e4f1fc61f81e054746110
- SHA1
  
  e083f3dcc54254c0fe0de5ddb1dd16b8dfd9b56f
- SHA256
  
  04f380864eb0622e58f6fa9b6e5acc93ae8c3eaeb0a8086ad15e3aac2d6484c0
- SHA512
  
  8ec5720c9e486fe5a52b89e84bd5c653e2f99032a19576baed0b1352fd0c84212e7410bdf56c8214c70238cc9928851eada635b063c9a17a654941fdb1456dd6
- SSDEEP
  
  12288:oGHasii9BiREnNRo2WVIngoh+11cJtumyCP6q1r8YRI06y/:86iRENerC+11ciVqCYRQc
Score

7^/10

persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer

behavioral2

persistencespywarestealer