r77 | 039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2 | Triage

Sharing

General

Target

039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2
Size

1.8MB
Sample

241015-w6pwhazele
MD5

06c3b75deae102144ec995312d6d208a
SHA1

9d7386202e4012460553e792beaa4c1820cf7d17
SHA256

039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2
SHA512

75c6b6c541d078e6374f0212929b20a57b0c9e6772f002dfb3d6eb86f7611bec36b115b3932d8b826c06e0183c77f5980ffe0dcbe7067f4208d91dd8aa3ada0f
SSDEEP

49152:SiDHNvsmt3qmLC26/59I+HV7CjfM6ZAMZnWMsKoIyW5hbh9CQEEOUwnZvAks:/HZ/Cd5u+HVh

Score

10^/10

r77 credential_access discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2
- Size
  
  1.8MB
- MD5
  
  06c3b75deae102144ec995312d6d208a
- SHA1
  
  9d7386202e4012460553e792beaa4c1820cf7d17
- SHA256
  
  039d48320a3edaf1db8a2a8b2d5b9ef5097959fedeb8b904267fc32b1c0061e2
- SHA512
  
  75c6b6c541d078e6374f0212929b20a57b0c9e6772f002dfb3d6eb86f7611bec36b115b3932d8b826c06e0183c77f5980ffe0dcbe7067f4208d91dd8aa3ada0f
- SSDEEP
  
  49152:SiDHNvsmt3qmLC26/59I+HV7CjfM6ZAMZnWMsKoIyW5hbh9CQEEOUwnZvAks:/HZ/Cd5u+HVh
Score

8^/10

credential_access discovery evasion stealer trojan spyware
- Disables taskbar notifications via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

credential_accessdiscoveryevasionstealertrojan

behavioral2

credential_accessdiscoveryevasionspywarestealertrojan