Overview

overview

10

Static

static

3

63545fa195...8a.exe

windows7-x64

10

63545fa195...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

  • Size

    324KB

  • Sample

    241204-pgz7lszqaq

  • MD5

    638a93d38b6832c36da61a7aaefa6833

  • SHA1

    8d3edf995b19c13824b80db6c11bdb886af25f39

  • SHA256

    1531bf98add8b075e96d517c257850358efef52be0ddd872a1d31cbaa1d1b653

  • SHA512

    022f8b3ad5404188d700535bfdf0ab5a284bb9c32e970e5f9442367921be73e089b77858866b057221f1baf8588daf7b83cb2a0ce7f4d3a73ece3a8eb0b92f3f

  • SSDEEP

    6144:y07opevrzaFHjaPv9TghqCCXsxnz5M0p0kxFu7Hue10fzv2:y08pq6F+Pv9TghRKMndMSLbrfzv2

Score
10/10
mimikatzbootkitdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

    • Size

      390KB

    • MD5

      5b7e6e352bacc93f7b80bc968b6ea493

    • SHA1

      e686139d5ed8528117ba6ca68fe415e4fb02f2be

    • SHA256

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

    • SHA512

      9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

    • SSDEEP

      12288:ef/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:EXATS/x9jNg+95vdQa

    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks