e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf

General

Target

xpajB.exe
Size

520KB
MD5

bd76fc01deed43cd6e368a1f860d44ed
SHA1

a2e241e9af346714e93c0600f160d05c95839768
SHA256

e04c85cd4bffa1f5465ff62c9baf0b29b7b2faddf7362789013fbac8c90268bf
SHA512

d0ebe108f5baf156ecd9e1bf41e23a76b043fcaac78ff5761fdca2740b71241bd827e861ada957891fbc426b3d7baa87d10724765c45e25f25aa7bd6d31ab4ec
SSDEEP

12288:Kbx6vZrcRsEQNMnnGpL0zTnPzCFjBL0C2k8apE:Kbx6vam9innGWzUB

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

xpajB.exe

description	ioc	process
File opened (read-only)	\??\j:	xpajB.exe
File opened (read-only)	\??\k:	xpajB.exe
File opened (read-only)	\??\n:	xpajB.exe
File opened (read-only)	\??\q:	xpajB.exe
File opened (read-only)	\??\u:	xpajB.exe
File opened (read-only)	\??\v:	xpajB.exe
File opened (read-only)	\??\w:	xpajB.exe
File opened (read-only)	\??\i:	xpajB.exe
File opened (read-only)	\??\m:	xpajB.exe
File opened (read-only)	\??\o:	xpajB.exe
File opened (read-only)	\??\p:	xpajB.exe
File opened (read-only)	\??\y:	xpajB.exe
File opened (read-only)	\??\h:	xpajB.exe
File opened (read-only)	\??\r:	xpajB.exe
File opened (read-only)	\??\s:	xpajB.exe
File opened (read-only)	\??\t:	xpajB.exe
File opened (read-only)	\??\e:	xpajB.exe
File opened (read-only)	\??\g:	xpajB.exe
File opened (read-only)	\??\l:	xpajB.exe
File opened (read-only)	\??\x:	xpajB.exe

Drops file in Program Files directory 64 IoCs

Processes:

xpajB.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\softokn3.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\IPEDITOR.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Common Files\System\msadc\msdaremr.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\FeedSync.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\npvlc.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\decora-sse.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSV.DLL	xpajB.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\jdwp.dll	xpajB.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SLINTL.DLL	xpajB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\jp2launcher.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_iw.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA000A.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.Adapter.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre7\bin\sunec.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	xpajB.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll	xpajB.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\jvm.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\dt_shmem.dll	xpajB.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceqp35.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Defender\MsMpLics.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Mail\wabimp.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll	xpajB.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll	xpajB.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSVCR71.DLL	xpajB.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

xpajB.exe

pid process

2232 xpajB.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

xpajB.exe

pid process

2232 xpajB.exe

pid	process
2232	xpajB.exe

pid	process
2232	xpajB.exe

C:\Users\Admin\AppData\Local\Temp\xpajB.exe
"C:\Users\Admin\AppData\Local\Temp\xpajB.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
PID:2232

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-1-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-2-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-3-0x0000000000100000-0x0000000000103000-memory.dmp

Filesize
12KB

Download
memory/2232-4-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download
memory/2232-6-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download
memory/2232-5-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-7-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2232-8-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-9-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-10-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-11-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-12-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download
memory/2232-13-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-14-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-15-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-16-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-17-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-18-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-19-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-20-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-22-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-23-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-24-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2232-25-0x0000000000320000-0x0000000000344000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing