Overview

overview

10

Static

static

1

1261454959...c8.exe

windows7-x64

10

1261454959...c8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1261454959b54c096e309a21cd22e06e995b34e8105a0aa772135fd02d923ec8.exe

  • Size

    63.2MB

  • Sample

    240726-bxtswaxgmq

  • MD5

    16d3c412e87797f2522c264cf1c194ff

  • SHA1

    9d780fe4e5f94a49132d2d7bd8782dbe17ec4c2d

  • SHA256

    1261454959b54c096e309a21cd22e06e995b34e8105a0aa772135fd02d923ec8

  • SHA512

    849b9d76c46929a0d5c4c918f874511b6a7270287dc7c298d7959b993dd3c14a13e431319cee615d90ac97b0a873a9464510cbf3b188adcd352c1ed823b2e6cc

  • SSDEEP

    1572864:NtDvUv/M7FOZ2W27XKzHzpoxQEB0Jj0iwMDcjgbMc7v3/+m7yX:DeOa122tbh0iwMDc8b77+m7yX

Score
10/10
epsiloncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      1261454959b54c096e309a21cd22e06e995b34e8105a0aa772135fd02d923ec8.exe

    • Size

      63.2MB

    • MD5

      16d3c412e87797f2522c264cf1c194ff

    • SHA1

      9d780fe4e5f94a49132d2d7bd8782dbe17ec4c2d

    • SHA256

      1261454959b54c096e309a21cd22e06e995b34e8105a0aa772135fd02d923ec8

    • SHA512

      849b9d76c46929a0d5c4c918f874511b6a7270287dc7c298d7959b993dd3c14a13e431319cee615d90ac97b0a873a9464510cbf3b188adcd352c1ed823b2e6cc

    • SSDEEP

      1572864:NtDvUv/M7FOZ2W27XKzHzpoxQEB0Jj0iwMDcjgbMc7v3/+m7yX:DeOa122tbh0iwMDc8b77+m7yX

    Score
    10/10
    epsiloncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

    • Epsilon Stealer

      Information stealer.

      stealerepsilon

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

1
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Process Discovery

1
T1057

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks