Overview

overview

10

Static

static

3

63545fa195...8a.exe

windows7-x64

10

63545fa195...8a.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

  • Size

    324KB

  • Sample

    241116-j21qzswpam

  • MD5

    7fab3cf874225f4771860ec96a9cf97a

  • SHA1

    c4a8739e1505cc2b7d81c56786becacebbc794f1

  • SHA256

    8f1510f1ebf5313e7284e106ec0f7b242eb327f486fc289d935477e69e1bb075

  • SHA512

    29061a916fadea93f1394a12ec83e66eebe794ac8d4cb57804d84cdc9fcdd0231135d973391142c290c857dfa2ade4d81ade31d0eda963537ca1eb233e44df91

  • SSDEEP

    6144:HHKNfnAlw5LsMgEKI+OwP2zm1w4IlKWgxYy7WNfOgr8zu2QopIvyE:nofYg4Om1EKZxJ7AO+1opGJ

Score
10/10
mimikatzbootkitdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

    • Size

      390KB

    • MD5

      5b7e6e352bacc93f7b80bc968b6ea493

    • SHA1

      e686139d5ed8528117ba6ca68fe415e4fb02f2be

    • SHA256

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

    • SHA512

      9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

    • SSDEEP

      12288:ef/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:EXATS/x9jNg+95vdQa

    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks