f877dcbb53d24e1afb9b9fcca3a5e81c480a65a0a3e8849607c095b6385f4be7 | Triage

Sharing

General

Target

HSBC_PAYMENT.exe
Size

1.5MB
Sample

240930-s9e9patbkr
MD5

2a7a9f6f897611b4e6acb7288c01288f
SHA1

59b27be560927f6b45338813f4c4a063849e3926
SHA256

f877dcbb53d24e1afb9b9fcca3a5e81c480a65a0a3e8849607c095b6385f4be7
SHA512

32e88f1cf751bce5cdcf1f257e18c74091487acb3b63e88d6e2b69553351e6ee9d4c4b175492399bbf13d8463c1db72a741ed03422c4734cfe2c8195b2ff82fe
SSDEEP

24576:ffmMv6Ckr7Mny5QLWDqs1zGYfWncb6G0kxvoff5uH4sOKruG2t96uMqBX5t8v:f3v+7/5QLWDqY7KG0klaBuYsOKSF6uMb

Score

7^/10

discovery spyware

Malware Config

Targets

- Target
  
  HSBC_PAYMENT.exe
- Size
  
  1.5MB
- MD5
  
  2a7a9f6f897611b4e6acb7288c01288f
- SHA1
  
  59b27be560927f6b45338813f4c4a063849e3926
- SHA256
  
  f877dcbb53d24e1afb9b9fcca3a5e81c480a65a0a3e8849607c095b6385f4be7
- SHA512
  
  32e88f1cf751bce5cdcf1f257e18c74091487acb3b63e88d6e2b69553351e6ee9d4c4b175492399bbf13d8463c1db72a741ed03422c4734cfe2c8195b2ff82fe
- SSDEEP
  
  24576:ffmMv6Ckr7Mny5QLWDqs1zGYfWncb6G0kxvoff5uH4sOKruG2t96uMqBX5t8v:f3v+7/5QLWDqY7KG0klaBuYsOKSF6uMb
Score

7^/10

discovery spyware
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryspyware

behavioral2

discoveryspyware