Overview

overview

10

Static

static

3

e6db7d34b4...42.exe

windows7-x64

10

e6db7d34b4...42.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42.exe

  • Size

    1.3MB

  • Sample

    240901-b6a25ayang

  • MD5

    db2a12edc73769f2f2b6b01545afe2c3

  • SHA1

    73dc44fb0753296f51b851299f468031ceb77b54

  • SHA256

    e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42

  • SHA512

    dadf36bc9c5d88c28b9064892cc263c912ce668435b71802df756c0a4e680f8407011d36498a2511dda7165aea866c0ae794f9ec8fbcc42c7da1661399316ce4

  • SSDEEP

    24576:UzZ1Futzu9df939+wlQ+u6M6NrPLyPts+5+OgoSsKWF5DcJ14lWCqMYDe1EpmqIu:UvF4a9d9tnlQ+u96NyPtP5+1GKWF5gzn

Score
10/10
credential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42.exe

    • Size

      1.3MB

    • MD5

      db2a12edc73769f2f2b6b01545afe2c3

    • SHA1

      73dc44fb0753296f51b851299f468031ceb77b54

    • SHA256

      e6db7d34b498982601b2c45ac5b2a1c1b9502e502514ccffae9862f2aa719f42

    • SHA512

      dadf36bc9c5d88c28b9064892cc263c912ce668435b71802df756c0a4e680f8407011d36498a2511dda7165aea866c0ae794f9ec8fbcc42c7da1661399316ce4

    • SSDEEP

      24576:UzZ1Futzu9df939+wlQ+u6M6NrPLyPts+5+OgoSsKWF5DcJ14lWCqMYDe1EpmqIu:UvF4a9d9tnlQ+u96NyPtP5+1GKWF5gzn

    Score
    10/10
    credential_accessdiscoveryspywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks