Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    049eaf34a048a80c4bdac29dbe453169f2b0927caec3e397c1b9eff016b9b415

  • Size

    1.7MB

  • Sample

    240909-fm8lhasgkr

  • MD5

    bdefc54e5fe6f091f968a28aa63783ba

  • SHA1

    812e7c68f9d31ad7d8e931d5a20529ef920a736c

  • SHA256

    049eaf34a048a80c4bdac29dbe453169f2b0927caec3e397c1b9eff016b9b415

  • SHA512

    43e3597df8118c956e08af657b5a39b323a0188cd0791016dab5a3e2dddda20a5c8cccd8d70555da77a3d6b3f1da999c5c46cb40e3ca0e77461f2669fdd18c24

  • SSDEEP

    49152:owy+Hniztba+Me18lyHU5GqiFtXWza2DxZl01:HywiztEA05GLHXj6m1

Score
10/10
collectiondiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      049eaf34a048a80c4bdac29dbe453169f2b0927caec3e397c1b9eff016b9b415

    • Size

      1.7MB

    • MD5

      bdefc54e5fe6f091f968a28aa63783ba

    • SHA1

      812e7c68f9d31ad7d8e931d5a20529ef920a736c

    • SHA256

      049eaf34a048a80c4bdac29dbe453169f2b0927caec3e397c1b9eff016b9b415

    • SHA512

      43e3597df8118c956e08af657b5a39b323a0188cd0791016dab5a3e2dddda20a5c8cccd8d70555da77a3d6b3f1da999c5c46cb40e3ca0e77461f2669fdd18c24

    • SSDEEP

      49152:owy+Hniztba+Me18lyHU5GqiFtXWza2DxZl01:HywiztEA05GLHXj6m1

    Score
    10/10
    collectiondiscoveryexecutionspywarestealer

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks