Overview

overview

10

Static

static

3

587c60135a...27.exe

windows7-x64

10

587c60135a...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    587c60135a92453e154c2b43cb769627.exe

  • Size

    3.6MB

  • Sample

    240808-r33wqsvdpn

  • MD5

    587c60135a92453e154c2b43cb769627

  • SHA1

    a72589522dad1f2e775bf0357be752b497887044

  • SHA256

    ededca3858ac217d88fae09e522be2ff721d86f146a37a01d0de98f7022ceaf6

  • SHA512

    db98a58d3ed52bb7cfc16ad763126bf2d91fc714b896e22f95026cb39f557e29e0eab87bd025ba6f17bb858e4ca94062516dd39e74b9fc4f6cb9a4d783443187

  • SSDEEP

    98304:xrdjMcy3IJfDBKmMiqn97P/M63hbP92xhDiy9:xr1OCfDdqn97Eobkx39

Score
10/10
credential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      587c60135a92453e154c2b43cb769627.exe

    • Size

      3.6MB

    • MD5

      587c60135a92453e154c2b43cb769627

    • SHA1

      a72589522dad1f2e775bf0357be752b497887044

    • SHA256

      ededca3858ac217d88fae09e522be2ff721d86f146a37a01d0de98f7022ceaf6

    • SHA512

      db98a58d3ed52bb7cfc16ad763126bf2d91fc714b896e22f95026cb39f557e29e0eab87bd025ba6f17bb858e4ca94062516dd39e74b9fc4f6cb9a4d783443187

    • SSDEEP

      98304:xrdjMcy3IJfDBKmMiqn97P/M63hbP92xhDiy9:xr1OCfDdqn97Eobkx39

    Score
    10/10
    credential_accessdiscoveryspywarestealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks