54d65e4843d5f69c32e50a76ae8d2efdb15f4113f08c722b6f70c265d2d8e4bf

General

Target
Sample 6874.Ref.Scan.exe
Size 505KB
Sample200624-eek5d7ap26
SHA256 54d65e4843d5f69c32e50a76ae8d2efdb15f4113f08c722b6f70c265d2d8e4bf
MD5 eb1f890af74b91496e18341a1f79cd8d
SHA1 c9cfbf82dc9cae37e9b2087747ba3ad38970a96c
SHA512 3a7412058f904e0c33affb108e513ca100384574777eb5c586367ec98200a821204e35bb286a6d19d406a3bee2050c305bc71f5a7b436e3c26dbcc7f63f238bc
MD5 SHA1 SHA512

Score

7^/10

spyware

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3792	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3792	3692	Sample 6874.Ref.Scan.exe	67
PID 3692 wrote to memory of 3792	3692	Sample 6874.Ref.Scan.exe	67
PID 3692 wrote to memory of 3792	3692	Sample 6874.Ref.Scan.exe	67
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69
PID 3692 wrote to memory of 3876	3692	Sample 6874.Ref.Scan.exe	69

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3692 set thread context of 3876	3692	Sample 6874.Ref.Scan.exe	69

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	Sample 6874.Ref.Scan.exe
Token: SeDebugPrivilege	3876	Sample 6874.Ref.Scan.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3876	Sample 6874.Ref.Scan.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Sample 6874.Ref.Scan.exe
"C:\Users\Admin\AppData\Local\Temp\Sample 6874.Ref.Scan.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3692
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CpoIGOgXDoB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB3F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\Sample 6874.Ref.Scan.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3876