1b3a9b2b91e235e345e7ed4e944e219133eed160548fb27594e9493ad71785a6

General

Target

ashleyx.exe
Size

657KB
MD5

609f7f62c1c1ed29c375f7f3a9cf272e
SHA1

0e942d0f6d73fa9c986e57cc0cbcfc9d3d6df538
SHA256

1b3a9b2b91e235e345e7ed4e944e219133eed160548fb27594e9493ad71785a6
SHA512

a3b9d026bdaa8c4711d7ecb8fe9eb1a2fc32f400b3c0d1f2e5ef81a33a7962277eaf8d663d8ca38f5593abf7524631113a07dbf47d8737b28be2a670b4590d8d

Score

8^/10

spyware persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

ashleyx.exenetsh.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	804	ashleyx.exe
Token: SeDebugPrivilege	992	netsh.exe
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Drops file in Program Files directory 1 IoCs

Processes:

netsh.exe

description ioc process

File opened for modification C:\Program Files (x86)\Yrdftj\updatesx5pxz9h.exe netsh.exe
System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

netsh.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer netsh.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Yrdftj\updatesx5pxz9h.exe	netsh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	netsh.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

ashleyx.exeashleyx.exenetsh.exe

pid	process
640	ashleyx.exe
640	ashleyx.exe
804	ashleyx.exe
804	ashleyx.exe
804	ashleyx.exe
804	ashleyx.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe
992	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ashleyx.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 640 wrote to memory of 804	640	ashleyx.exe	ashleyx.exe
PID 640 wrote to memory of 804	640	ashleyx.exe	ashleyx.exe
PID 640 wrote to memory of 804	640	ashleyx.exe	ashleyx.exe
PID 3024 wrote to memory of 992	3024	Explorer.EXE	netsh.exe
PID 3024 wrote to memory of 992	3024	Explorer.EXE	netsh.exe
PID 3024 wrote to memory of 992	3024	Explorer.EXE	netsh.exe
PID 992 wrote to memory of 1104	992	netsh.exe	cmd.exe
PID 992 wrote to memory of 1104	992	netsh.exe	cmd.exe
PID 992 wrote to memory of 1104	992	netsh.exe	cmd.exe
PID 992 wrote to memory of 4012	992	netsh.exe	cmd.exe
PID 992 wrote to memory of 4012	992	netsh.exe	cmd.exe
PID 992 wrote to memory of 4012	992	netsh.exe	cmd.exe
PID 992 wrote to memory of 4020	992	netsh.exe	Firefox.exe
PID 992 wrote to memory of 4020	992	netsh.exe	Firefox.exe
PID 992 wrote to memory of 4020	992	netsh.exe	Firefox.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

ashleyx.exeashleyx.exenetsh.exe

pid process

640 ashleyx.exe
804 ashleyx.exe
804 ashleyx.exe
804 ashleyx.exe
992 netsh.exe
992 netsh.exe
992 netsh.exe
992 netsh.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ashleyx.exeashleyx.exenetsh.exe

description	pid	process	target process
PID 640 set thread context of 804	640	ashleyx.exe	ashleyx.exe
PID 804 set thread context of 3024	804	ashleyx.exe	Explorer.EXE
PID 992 set thread context of 3024	992	netsh.exe	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE

pid	process
3024	Explorer.EXE

pid	process
3024	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

netsh.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netsh.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

netsh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	netsh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XRD0DXBP = "C:\\Program Files (x86)\\Yrdftj\\updatesx5pxz9h.exe"	netsh.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3024

C:\Users\Admin\AppData\Local\Temp\ashleyx.exe
"C:\Users\Admin\AppData\Local\Temp\ashleyx.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:640

C:\Users\Admin\AppData\Local\Temp\ashleyx.exe
"C:\Users\Admin\AppData\Local\Temp\ashleyx.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:804

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Adds Run entry to policy start application
PID:992

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ashleyx.exe"
3⤵
PID:1104

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:4012

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:4020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DB1

Download Submit
C:\Users\Admin\AppData\Roaming\OLMPT2RS\OLMlogim.jpeg

Download Submit
C:\Users\Admin\AppData\Roaming\OLMPT2RS\OLMlogrf.ini

Download Submit
C:\Users\Admin\AppData\Roaming\OLMPT2RS\OLMlogrg.ini

Download Submit
C:\Users\Admin\AppData\Roaming\OLMPT2RS\OLMlogri.ini

Download Submit
C:\Users\Admin\AppData\Roaming\OLMPT2RS\OLMlogrv.ini

Download Submit
memory/804-1-0x000000000041E280-mapping.dmp

Download
memory/804-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/992-5-0x0000000000B50000-0x0000000000B6E000-memory.dmp

Filesize
120KB

Download
memory/992-11-0x0000000006D30000-0x0000000006E5D000-memory.dmp

Filesize
1.2MB

Download
memory/992-7-0x0000000004700000-0x000000000479E000-memory.dmp

Filesize
632KB

Download
memory/992-4-0x0000000000B50000-0x0000000000B6E000-memory.dmp

Filesize
120KB

Download
memory/992-3-0x0000000000000000-mapping.dmp

Download
memory/1104-6-0x0000000000000000-mapping.dmp

Download
memory/4012-9-0x0000000000000000-mapping.dmp

Download
memory/4020-12-0x0000000000000000-mapping.dmp

Download
memory/4020-13-0x00007FF7C03D0000-0x00007FF7C0463000-memory.dmp

Filesize
588KB

Download
memory/4020-14-0x00007FF7C03D0000-0x00007FF7C0463000-memory.dmp

Filesize
588KB

Download
memory/4020-15-0x00007FF7C03D0000-0x00007FF7C0463000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads