Extracted

Extracted

• • Target

    17345063495d9ff9a239e91022aad8f2d11b89f02854c4b148235396ec7a0562f12ac23b56442.dat-decoded.exe

  • Size

    429KB

  • MD5

    0d323be01f1a4edfd1c8e9f2c344a374

  • SHA1

    08a5cd24b9898676c2b6f8a88b5d42027c05085a

  • SHA256

    c81c405cc7c101ef8dd7c32a457c69495663f46c6039c5dc38e7e8b485b9840f

  • SHA512

    e55cd4dc8c5e24db29f3f2557161af03fd3609474a019fe22285cac04b75878799cdd7ea4e63eafa5fbc75f4318b0d2824a5afd64d8de66c4c0584307dd878de

  • SSDEEP

    6144:3+d2+U+8RRJorR7zu6tF9x46YGg83lgnbJHZFXUU01yC5wJ/3AO2HyXGcKcOxuf:3+d3UGddn4F83l0JjXUU0kXAHTceuf

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryevasionexecutionpersistencephishingprivilege_escalationspywarestealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Looks for Xen service registry key.

    evasion

  • Sets service image path in registry

    persistence

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1