Overview

overview

8

Static

static

3

cryptolaemus

windows10-2004-x64

7

cryptolaemus

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb6bf78a0a00e58d4e222a2d4979bbf1fdbf051e4a51bea06a1d8a8f5a08f2c5

  • Size

    3.3MB

  • Sample

    240807-wkb3hs1fpr

  • MD5

    20682c5671ee69175bbbdc844db96934

  • SHA1

    3d0d6845c66e39056c7f4c8009d4fb957c5d2cb3

  • SHA256

    eb6bf78a0a00e58d4e222a2d4979bbf1fdbf051e4a51bea06a1d8a8f5a08f2c5

  • SHA512

    82431f567f0d2dcbd96ddbebfa6c098481e643e4fcf2bf9122f167233de3955e677ba55c8634b5728476f50d1056ea90ec2f290a03667720f16fe5ce70916d4a

  • SSDEEP

    49152:qQtQRTMYIMi7ztfDyw20xoxJI/LfL8vh3UT/yxfBtVp/0RwEV0gcijtI9uv+i3cb:jtQRjdihmwVxz4JkT/ytSwi0gJ53+v5

Score
8/10
credential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      eb6bf78a0a00e58d4e222a2d4979bbf1fdbf051e4a51bea06a1d8a8f5a08f2c5

    • Size

      3.3MB

    • MD5

      20682c5671ee69175bbbdc844db96934

    • SHA1

      3d0d6845c66e39056c7f4c8009d4fb957c5d2cb3

    • SHA256

      eb6bf78a0a00e58d4e222a2d4979bbf1fdbf051e4a51bea06a1d8a8f5a08f2c5

    • SHA512

      82431f567f0d2dcbd96ddbebfa6c098481e643e4fcf2bf9122f167233de3955e677ba55c8634b5728476f50d1056ea90ec2f290a03667720f16fe5ce70916d4a

    • SSDEEP

      49152:qQtQRTMYIMi7ztfDyw20xoxJI/LfL8vh3UT/yxfBtVp/0RwEV0gcijtI9uv+i3cb:jtQRjdihmwVxz4JkT/ytSwi0gJ53+v5

    Score
    8/10
    credential_accessdiscoveryransomwarespywarestealerpersistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks