4ceac8889d18635deb9bd445cc15411af192f959186242e6d3e82c5326ae53fc

General

Target

Start.exe
Size

37.7MB
Sample

240920-l9ql4a1dng
MD5

a226c4a3b3f80861f9f91990ba69e6c5
SHA1

7d611dbf0e4305506e4fbebd50f585b41f26227b
SHA256

4ceac8889d18635deb9bd445cc15411af192f959186242e6d3e82c5326ae53fc
SHA512

c24621327aa8c9fc57ff7d8a58471585ee01efbacf9c3291f81dbc05881f84d21dddd3c714b9f87eb74dfd08bd95283157c3120efd5feb926041e4c6e9268054
SSDEEP

393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgi96l+ZArYsFRlF5L:R3on1HvSzxAMNiFZArYs3Pvas7OZoT

Score

10^/10

Malware Config

Targets

- Target
  
  Start.exe
- Size
  
  37.7MB
- MD5
  
  a226c4a3b3f80861f9f91990ba69e6c5
- SHA1
  
  7d611dbf0e4305506e4fbebd50f585b41f26227b
- SHA256
  
  4ceac8889d18635deb9bd445cc15411af192f959186242e6d3e82c5326ae53fc
- SHA512
  
  c24621327aa8c9fc57ff7d8a58471585ee01efbacf9c3291f81dbc05881f84d21dddd3c714b9f87eb74dfd08bd95283157c3120efd5feb926041e4c6e9268054
- SSDEEP
  
  393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgi96l+ZArYsFRlF5L:R3on1HvSzxAMNiFZArYs3Pvas7OZoT
Score

10^/10

credential_access discovery evasion execution persistence spyware stealer trojan
- UAC bypass
  evasion trojan
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1