06d770563253e518dd207abb9bb30d0ba69b393bc4fa7f1cc9999f0ea1b661f0

General

Target

PO 30091.exe
Size

941KB
MD5

75f65167ca6e0e2a9495c6c014ada606
SHA1

0ed6f49a4333fba64d5bed0037cf8c96b9f6a940
SHA256

06d770563253e518dd207abb9bb30d0ba69b393bc4fa7f1cc9999f0ea1b661f0
SHA512

390c68138807254f44df8ae692921a9530f10ac7a63d3e7db10020734bf6421661d94f994a1fa4fbe0767ed165fac391824dbfe5ce6401115809a81a8eb70862

Score

8^/10

persistence spyware evasion trojan

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

Processes:

PO 30091.exePO 30091.exenetsh.exe

description	pid	process	target process
PID 1092 set thread context of 1248	1092	PO 30091.exe	PO 30091.exe
PID 1248 set thread context of 1192	1248	PO 30091.exe	Explorer.EXE
PID 1248 set thread context of 1192	1248	PO 30091.exe	Explorer.EXE
PID 744 set thread context of 1192	744	netsh.exe	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE

pid	process
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

netsh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	netsh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DPWTYLT0VPX = "C:\\Program Files (x86)\\Ygbcpjfbp\\mfc7n7l_rn0.exe"	netsh.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

PO 30091.exePO 30091.exenetsh.exe

pid	process
1092	PO 30091.exe
1248	PO 30091.exe
1248	PO 30091.exe
1248	PO 30091.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe
744	netsh.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

PO 30091.exeExplorer.EXEnetsh.exe

description	pid	process	target process
PID 1092 wrote to memory of 1248	1092	PO 30091.exe	PO 30091.exe
PID 1092 wrote to memory of 1248	1092	PO 30091.exe	PO 30091.exe
PID 1092 wrote to memory of 1248	1092	PO 30091.exe	PO 30091.exe
PID 1092 wrote to memory of 1248	1092	PO 30091.exe	PO 30091.exe
PID 1192 wrote to memory of 744	1192	Explorer.EXE	netsh.exe
PID 1192 wrote to memory of 744	1192	Explorer.EXE	netsh.exe
PID 1192 wrote to memory of 744	1192	Explorer.EXE	netsh.exe
PID 1192 wrote to memory of 744	1192	Explorer.EXE	netsh.exe
PID 744 wrote to memory of 108	744	netsh.exe	cmd.exe
PID 744 wrote to memory of 108	744	netsh.exe	cmd.exe
PID 744 wrote to memory of 108	744	netsh.exe	cmd.exe
PID 744 wrote to memory of 108	744	netsh.exe	cmd.exe
PID 744 wrote to memory of 1308	744	netsh.exe	Firefox.exe
PID 744 wrote to memory of 1308	744	netsh.exe	Firefox.exe
PID 744 wrote to memory of 1308	744	netsh.exe	Firefox.exe
PID 744 wrote to memory of 1308	744	netsh.exe	Firefox.exe
PID 744 wrote to memory of 1308	744	netsh.exe	Firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

netsh.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer netsh.exe

pid	process
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	netsh.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

netsh.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	netsh.exe

Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

PO 30091.exePO 30091.exenetsh.exe

pid process

1092 PO 30091.exe
1248 PO 30091.exe
1248 PO 30091.exe
1248 PO 30091.exe
1248 PO 30091.exe
744 netsh.exe
744 netsh.exe
744 netsh.exe
744 netsh.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO 30091.exenetsh.exe

description pid process

Token: SeDebugPrivilege 1248 PO 30091.exe
Token: SeDebugPrivilege 744 netsh.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

108 cmd.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Drops file in Program Files directory 1 IoCs

Processes:

netsh.exe

description ioc process

File opened for modification C:\Program Files (x86)\Ygbcpjfbp\mfc7n7l_rn0.exe netsh.exe

description	pid	process
Token: SeDebugPrivilege	1248	PO 30091.exe
Token: SeDebugPrivilege	744	netsh.exe

pid	process
108	cmd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Ygbcpjfbp\mfc7n7l_rn0.exe	netsh.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1192

C:\Users\Admin\AppData\Local\Temp\PO 30091.exe
"C:\Users\Admin\AppData\Local\Temp\PO 30091.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1092

C:\Users\Admin\AppData\Local\Temp\PO 30091.exe
"C:\Users\Admin\AppData\Local\Temp\PO 30091.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
- Suspicious use of SetThreadContext
- Adds Run entry to policy start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
PID:744

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PO 30091.exe"
3⤵
- Deletes itself
PID:108

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\L5P8R4-3\L5Plogim.jpeg

Download Submit
C:\Users\Admin\AppData\Roaming\L5P8R4-3\L5Plogrf.ini

Download Submit
C:\Users\Admin\AppData\Roaming\L5P8R4-3\L5Plogri.ini

Download Submit
C:\Users\Admin\AppData\Roaming\L5P8R4-3\L5Plogrv.ini

Download Submit
memory/108-5-0x0000000000000000-mapping.dmp

Download
memory/744-4-0x00000000015A0000-0x00000000015BB000-memory.dmp

Filesize
108KB

Download
memory/744-6-0x00000000012B0000-0x0000000001425000-memory.dmp

Filesize
1.5MB

Download
memory/744-7-0x0000000075850000-0x000000007585C000-memory.dmp

Filesize
48KB

Download
memory/744-8-0x0000000075DB0000-0x0000000075ECD000-memory.dmp

Filesize
1.1MB

Download
memory/744-14-0x00000000035D0000-0x000000000368B000-memory.dmp

Filesize
748KB

Download
memory/744-3-0x0000000000000000-mapping.dmp

Download
memory/1192-2-0x0000000006920000-0x0000000006AC3000-memory.dmp

Filesize
1.6MB

Download
memory/1248-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1248-1-0x000000000041E330-mapping.dmp

Download
memory/1308-15-0x0000000000000000-mapping.dmp

Download
memory/1308-16-0x000000013FB10000-0x000000013FBA3000-memory.dmp

Filesize
588KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads