Overview

overview

10

Static

static

3

63545fa195...8a.exe

windows7-x64

10

63545fa195...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.zip

  • Size

    324KB

  • Sample

    250220-qcy97awjdr

  • MD5

    467ebcb9e5dcd270ed68da28e4a3ff22

  • SHA1

    e73d259d3429a5e7c29a54455fd837f8730ec883

  • SHA256

    beeaabf006160631f868ba623ec5eb12234ea9491a986de8c2f17cc602100d4f

  • SHA512

    abf2af86a6e1f7e13ffc45bd1f6a5a73cab73ec95b0cd884431caa4cf231a5ccbc7e51df4b59fbd852c2d6ed0b0465b058e5886c919b4c969dbb073ad7ed87d6

  • SSDEEP

    6144:QiDnu106MsUyR5oLcnF6ckShjh6uguwH4+RAfOIlIB2lHaQzPfopa:Qu80ZsUyR5UcFnphFeXH4oAtl2Q7fma

Score
10/10
mimikatzbootkitdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

    • Size

      390KB

    • MD5

      5b7e6e352bacc93f7b80bc968b6ea493

    • SHA1

      e686139d5ed8528117ba6ca68fe415e4fb02f2be

    • SHA256

      63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

    • SHA512

      9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

    • SSDEEP

      12288:ef/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:EXATS/x9jNg+95vdQa

    Score
    10/10
    mimikatzbootkitdiscoverypersistencespywarestealer

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks