Extracted

Extracted

• • Target
    4hnp2bb.exe
  • Size 900KB
  • SHA256 67318067cb47d58ff2b143a09d879f05485dd9f0233ccd2ad21d9e9b8f8e7fab
  • MD5 422a9c9b9487833b2487397729bcaa2c
  • SHA1 98da48586f40305b616c9332c2e90a6e4b4cc3a9
  • SHA512 33d26eac323004e40c7327045f6fb62df53cf75009d98fd7f1022d8b25110402404069ae627f360af03e4a78f66c980d4d995fdc9169f9baf9130ab27200f70e
  • SSDEEP 12288:4hZ5H2ggb3067PrTcmD1WOuZW/o1klZzVfRFgXmkR+ETi4DvHOl2:W/DOzPsmD7CW/oWPZfRa1JTi4Gl2
  • TLSH
    T161159D05E55853BBC59A41B78AD1336BC261FCA40379CAF723E03F681B469E45BB1B0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistencespywarestealerdefense_evasionprivilege_escalationupx

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2