Overview

overview

7

Static

static

X4EbSoE9zyT73W8.exe

windows7_x64

7

X4EbSoE9zyT73W8.exe

windows10_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    X4EbSoE9zyT73W8.exe

  • Size

    303KB

  • Sample

    200630-eltcnce94a

  • MD5

    36a98997a49aecb3bdb906085560ad8f

  • SHA1

    dfe0df5a15ca5400f2c63e16ede906621778e968

  • SHA256

    35b0f0ea8e64564dacb06fb7c9c4816cbe2962e27c72e83b6cca54c92582a620

  • SHA512

    fb0bb249a7db74c2cc5ded85054ee93fb4dc1402ceac66486a57b35f413b8341cefed6ce396841d2ac5a33e291c9f1a4e3b47e42457b3496b99ea80a6af50dd8

Score
7/10
persistencespyware

Malware Config

Targets

    • Target

      X4EbSoE9zyT73W8.exe

    • Size

      303KB

    • MD5

      36a98997a49aecb3bdb906085560ad8f

    • SHA1

      dfe0df5a15ca5400f2c63e16ede906621778e968

    • SHA256

      35b0f0ea8e64564dacb06fb7c9c4816cbe2962e27c72e83b6cca54c92582a620

    • SHA512

      fb0bb249a7db74c2cc5ded85054ee93fb4dc1402ceac66486a57b35f413b8341cefed6ce396841d2ac5a33e291c9f1a4e3b47e42457b3496b99ea80a6af50dd8

    Score
    7/10
    spywarepersistence

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks