eb071bd316e6c178749f622d90124be85a871aea6f87b3f6786e302f6e98a6a5

General

Target

Inquiry109346pdf.exe
Size

680KB
MD5

c2d53f65e668bb1506452442d406cd35
SHA1

db8e154de49341d553960463de1ef7aa845d30ce
SHA256

eb071bd316e6c178749f622d90124be85a871aea6f87b3f6786e302f6e98a6a5
SHA512

298f540825b0b19cae883b6738b070d12ed4d1be029ea0cbf99e1e7178ceaae88b4ea0f82fbf2a01af52edaad9400389d49646e19774b524c3a0ceaf6502324a

Score

7^/10

persistence spyware

Malware Config

Signatures

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Inquiry109346pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Xasm = "C:\\Users\\Admin\\AppData\\Local\\Xasm\\Xasm.hta"	Inquiry109346pdf.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Inquiry109346pdf.exe

description	pid	process	target process
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe
PID 1544 wrote to memory of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Inquiry109346pdf.exe

description pid process target process

PID 1544 set thread context of 1752 1544 Inquiry109346pdf.exe ieinstal.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ieinstal.exe

pid process

1752 ieinstal.exe
Loads dropped DLL 6 IoCs

Processes:

ieinstal.exe

pid process

1752 ieinstal.exe
1752 ieinstal.exe
1752 ieinstal.exe
1752 ieinstal.exe
1752 ieinstal.exe
1752 ieinstal.exe

description	pid	process	target process
PID 1544 set thread context of 1752	1544	Inquiry109346pdf.exe	ieinstal.exe

pid	process
1752	ieinstal.exe

pid	process
1752	ieinstal.exe
1752	ieinstal.exe
1752	ieinstal.exe
1752	ieinstal.exe
1752	ieinstal.exe
1752	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\Inquiry109346pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry109346pdf.exe"
1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1544

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
PID:1752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\freebl3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\mozglue.dll

Download Submit
\Users\Admin\AppData\Local\Temp\msvcp140.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nss3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\softokn3.dll

Download Submit
\Users\Admin\AppData\Local\Temp\vcruntime140.dll

Download Submit
memory/1752-0-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/1752-1-0x0000000000405907-mapping.dmp

Download
memory/1752-2-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing