806c14c42c59c7758edaedba1677631eb532ec18b4dd0fcd5f99d2d9eaa365ae | Triage

Sharing

General

Target

2024-08-29_9860f37092189c6bc58d555dfe306ce9_bkransomware
Size

262KB
Sample

240829-hmjcqazhrm
MD5

9860f37092189c6bc58d555dfe306ce9
SHA1

cf194da9c6a20ae6dbfc795884be249670dc58f0
SHA256

806c14c42c59c7758edaedba1677631eb532ec18b4dd0fcd5f99d2d9eaa365ae
SHA512

29207c4b9ebdf023d555fbb10d4b7142b7cdf25c5ddfaf0865452752bfe40213825d8380d1426fb8d721739e9f50364163ac23a539f39299a21e9b809016714d
SSDEEP

6144:hZMazWIGm3eA0qh1pMjkr9Kiwsb0eb3UPW2pE5:hS0WIGeeAvnpdr9tZbkeQE5

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  2024-08-29_9860f37092189c6bc58d555dfe306ce9_bkransomware
- Size
  
  262KB
- MD5
  
  9860f37092189c6bc58d555dfe306ce9
- SHA1
  
  cf194da9c6a20ae6dbfc795884be249670dc58f0
- SHA256
  
  806c14c42c59c7758edaedba1677631eb532ec18b4dd0fcd5f99d2d9eaa365ae
- SHA512
  
  29207c4b9ebdf023d555fbb10d4b7142b7cdf25c5ddfaf0865452752bfe40213825d8380d1426fb8d721739e9f50364163ac23a539f39299a21e9b809016714d
- SSDEEP
  
  6144:hZMazWIGm3eA0qh1pMjkr9Kiwsb0eb3UPW2pE5:hS0WIGeeAvnpdr9tZbkeQE5
Score

7^/10

discovery persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencespywarestealer

behavioral2

discoverypersistencespywarestealer