General
- Target d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.exe
- Size 11.1MB
- Sample260707-rt1d9afv2z
- SHA256 d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07
Score
8/10
Malware Config
Targets
-
- Target d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07.exe
- Size 11.1MB
- SHA256 d6ed06cae2e7942bce4b94005678cda9e488ce22903458ce19fe2c06073f2d07
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Creates new service(s)
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1