af6f6618d0587d510a90d9443c83cd03ae01a05b5aaf5ca8f6998c4dea593337 | Triage

Sharing

General

Target

61ee60da4584d6c14e2ff83fb96ee8d0N.exe
Size

254KB
Sample

240823-hrsrys1akd
MD5

61ee60da4584d6c14e2ff83fb96ee8d0
SHA1

9d8dc6f72e2ea981e1fc28be3bfa4067f21c15a2
SHA256

af6f6618d0587d510a90d9443c83cd03ae01a05b5aaf5ca8f6998c4dea593337
SHA512

66102382e7eab8d96134d946e7b4d1a4762923768122c50d42661e8552038bc445d700d9f9ffae0fa6189d9368d10f24ca6e373bdc77ed16a930467863444cf4
SSDEEP

6144:GjYKlAhUBVB3pQOS+hENlFgy81B9fAd0RPhQgXi0qOt+xCi:GjYRm7QOS+ynFgDS0ZYtOt6R

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  61ee60da4584d6c14e2ff83fb96ee8d0N.exe
- Size
  
  254KB
- MD5
  
  61ee60da4584d6c14e2ff83fb96ee8d0
- SHA1
  
  9d8dc6f72e2ea981e1fc28be3bfa4067f21c15a2
- SHA256
  
  af6f6618d0587d510a90d9443c83cd03ae01a05b5aaf5ca8f6998c4dea593337
- SHA512
  
  66102382e7eab8d96134d946e7b4d1a4762923768122c50d42661e8552038bc445d700d9f9ffae0fa6189d9368d10f24ca6e373bdc77ed16a930467863444cf4
- SSDEEP
  
  6144:GjYKlAhUBVB3pQOS+hENlFgy81B9fAd0RPhQgXi0qOt+xCi:GjYRm7QOS+ynFgDS0ZYtOt6R
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer