d64f69178b028dfba9674529eb0382fdfa3a7b84f6eac0849b4ee8ef9e391672 | Triage

Sharing

General

Target

02b97176e101a67b7577765fa9952910N.exe
Size

1.2MB
Sample

240801-zhwkxswdmp
MD5

02b97176e101a67b7577765fa9952910
SHA1

1e35f27a4d34752c7eef837c070f5213c2099c40
SHA256

d64f69178b028dfba9674529eb0382fdfa3a7b84f6eac0849b4ee8ef9e391672
SHA512

4848b0e7e5a6cbb5495bc4d79e87f41180a2d3b70ca42bba9763c240c254ae766febb7f9fd31fd91deda02ca90e784261d56bca315e70d0f874ae6a6168d3237
SSDEEP

24576:oWZ8Zlz2FIFdoSziQyF6J1s8169cSF5FVQiwdt7WDhmCX:VZcFKoiQyqH16u8F+3X7k

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  02b97176e101a67b7577765fa9952910N.exe
- Size
  
  1.2MB
- MD5
  
  02b97176e101a67b7577765fa9952910
- SHA1
  
  1e35f27a4d34752c7eef837c070f5213c2099c40
- SHA256
  
  d64f69178b028dfba9674529eb0382fdfa3a7b84f6eac0849b4ee8ef9e391672
- SHA512
  
  4848b0e7e5a6cbb5495bc4d79e87f41180a2d3b70ca42bba9763c240c254ae766febb7f9fd31fd91deda02ca90e784261d56bca315e70d0f874ae6a6168d3237
- SSDEEP
  
  24576:oWZ8Zlz2FIFdoSziQyF6J1s8169cSF5FVQiwdt7WDhmCX:VZcFKoiQyqH16u8F+3X7k
Score

7^/10

discovery persistence spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer