54d65e4843d5f69c32e50a76ae8d2efdb15f4113f08c722b6f70c265d2d8e4bf

General

Target
Sample 6874.Ref.Scan.exe
Size 505KB
Sample200624-eek5d7ap26
SHA256 54d65e4843d5f69c32e50a76ae8d2efdb15f4113f08c722b6f70c265d2d8e4bf
MD5 eb1f890af74b91496e18341a1f79cd8d
SHA1 c9cfbf82dc9cae37e9b2087747ba3ad38970a96c
SHA512 3a7412058f904e0c33affb108e513ca100384574777eb5c586367ec98200a821204e35bb286a6d19d406a3bee2050c305bc71f5a7b436e3c26dbcc7f63f238bc
MD5 SHA1 SHA512

Score

7^/10

spyware

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1088	Sample 6874.Ref.Scan.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
740	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 740	1424	Sample 6874.Ref.Scan.exe	24
PID 1424 wrote to memory of 740	1424	Sample 6874.Ref.Scan.exe	24
PID 1424 wrote to memory of 740	1424	Sample 6874.Ref.Scan.exe	24
PID 1424 wrote to memory of 740	1424	Sample 6874.Ref.Scan.exe	24
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26
PID 1424 wrote to memory of 1088	1424	Sample 6874.Ref.Scan.exe	26

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1424 set thread context of 1088	1424	Sample 6874.Ref.Scan.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	Sample 6874.Ref.Scan.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	Sample 6874.Ref.Scan.exe
1088	Sample 6874.Ref.Scan.exe

C:\Users\Admin\AppData\Local\Temp\Sample 6874.Ref.Scan.exe
"C:\Users\Admin\AppData\Local\Temp\Sample 6874.Ref.Scan.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1424
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CpoIGOgXDoB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB52B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:740
- C:\Users\Admin\AppData\Local\Temp\Sample 6874.Ref.Scan.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1088