Overview

overview

7

Static

static

3

8360a86def...0N.exe

windows7-x64

7

8360a86def...0N.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    8360a86defac834cd82edf7deed5e4f0N.exe

  • Size

    3.1MB

  • Sample

    240802-k5m5qstfmn

  • MD5

    8360a86defac834cd82edf7deed5e4f0

  • SHA1

    79a86efc7452cd294656bd3898a5465d34d5bce0

  • SHA256

    58e2d8ba3aa1686290e5ab16ef4cc5c6249fb16a079def665532e53a84dbcdb8

  • SHA512

    74274fcb70b4dcd195c3639d0fff57e53fbfb278c03285c89ec61cbc58ace5558e0e751b22c5679fc264d97e4f59a7f6792e2085f394c0f8f1bd516ba230e662

  • SSDEEP

    49152:mFoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbXsFBURPcyJpaB:1HgNDfXQ1veFPk5FaoCRrgGUDxhPz+X

Score
7/10
discoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      8360a86defac834cd82edf7deed5e4f0N.exe

    • Size

      3.1MB

    • MD5

      8360a86defac834cd82edf7deed5e4f0

    • SHA1

      79a86efc7452cd294656bd3898a5465d34d5bce0

    • SHA256

      58e2d8ba3aa1686290e5ab16ef4cc5c6249fb16a079def665532e53a84dbcdb8

    • SHA512

      74274fcb70b4dcd195c3639d0fff57e53fbfb278c03285c89ec61cbc58ace5558e0e751b22c5679fc264d97e4f59a7f6792e2085f394c0f8f1bd516ba230e662

    • SSDEEP

      49152:mFoHgEIXrjXfE44zAKveF+7YdOcYTBZEjUqxZgJGLfgqjJUDYWbXsFBURPcyJpaB:1HgNDfXQ1veFPk5FaoCRrgGUDxhPz+X

    Score
    7/10
    discoverypersistenceprivilege_escalationspywarestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Defense Evasion

Modify Registry

1
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks