Overview

overview

10

Static

static

3

616bf95fe0...0N.exe

windows7-x64

10

616bf95fe0...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    616bf95fe0f8ef817bbfd88a4122b3c0N.exe

  • Size

    260KB

  • Sample

    240820-k442vstdmg

  • MD5

    616bf95fe0f8ef817bbfd88a4122b3c0

  • SHA1

    2049e90d1f10e58862c47cf253268c010eaa7318

  • SHA256

    0e5f9593166a9dd14c097be31a34c1e154436b37bde539921dde57e261ac70b6

  • SHA512

    833349879d3b7157d89b6497f58d62b6c71f5cc46839bd20213d0e420ff2ce2b027a5fb2655c31ad296cf3d445b46d468c683800a7a2aaa0f1a76ca5d0027595

  • SSDEEP

    6144:RyZcAuFcCf38XolyxnDFJ6VNeVt7OUYfjOkT+Ekkr+fOyN1TUMDh:YTOcCf6yVQIdL41f9IWh

Score
10/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      616bf95fe0f8ef817bbfd88a4122b3c0N.exe

    • Size

      260KB

    • MD5

      616bf95fe0f8ef817bbfd88a4122b3c0

    • SHA1

      2049e90d1f10e58862c47cf253268c010eaa7318

    • SHA256

      0e5f9593166a9dd14c097be31a34c1e154436b37bde539921dde57e261ac70b6

    • SHA512

      833349879d3b7157d89b6497f58d62b6c71f5cc46839bd20213d0e420ff2ce2b027a5fb2655c31ad296cf3d445b46d468c683800a7a2aaa0f1a76ca5d0027595

    • SSDEEP

      6144:RyZcAuFcCf38XolyxnDFJ6VNeVt7OUYfjOkT+Ekkr+fOyN1TUMDh:YTOcCf6yVQIdL41f9IWh

    Score
    10/10
    adwarediscoveryevasionpersistencestealertrojan

    • UAC bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks