f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5

General

Target
f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe
Size 643KB
Sample200706-b96c5z8trx
SHA256 f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5
MD5 0d3543c663aeff15f03edf6dabad3ef1
SHA1 d3e6ec1ec3701c310a31733a489753a88153909e
SHA512 3a66f0b01516387ecad814fb55d99d2fbfc059d1eff8714df6a3a871fd79f3c54a82eef295f2a79fd4989d27257621ea5d280607d9de98feca98b6126331f464
MD5 SHA1 SHA512

Score

8^/10

spyware

Malware Config

Signatures

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	bMMmnU5Pk3Dd0eoAmVeK.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ipinfo.io
9	ipinfo.io

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 3840	3404	f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe	67
PID 3404 wrote to memory of 3840	3404	f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe	67
PID 3404 wrote to memory of 3840	3404	f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe	67
PID 3840 wrote to memory of 4020	3840	WScript.exe	68
PID 3840 wrote to memory of 4020	3840	WScript.exe	68
PID 3840 wrote to memory of 4020	3840	WScript.exe	68
PID 4020 wrote to memory of 4016	4020	cmd.exe	70
PID 4020 wrote to memory of 4016	4020	cmd.exe	70
PID 4020 wrote to memory of 4016	4020	cmd.exe	70
PID 4016 wrote to memory of 3144	4016	bMMmnU5Pk3Dd0eoAmVeK.exe	71
PID 4016 wrote to memory of 3144	4016	bMMmnU5Pk3Dd0eoAmVeK.exe	71
PID 4016 wrote to memory of 3144	4016	bMMmnU5Pk3Dd0eoAmVeK.exe	71
PID 3144 wrote to memory of 3116	3144	WScript.exe	72
PID 3144 wrote to memory of 3116	3144	WScript.exe	72
PID 3144 wrote to memory of 3116	3144	WScript.exe	72
PID 3116 wrote to memory of 3436	3116	cmd.exe	74
PID 3116 wrote to memory of 3436	3116	cmd.exe	74

Executes dropped EXE 2 IoCs

pid	Process
4016	bMMmnU5Pk3Dd0eoAmVeK.exe
3436	svcruntime.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	svcruntime.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	svcruntime.exe
3436	svcruntime.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3436	svcruntime.exe

C:\Users\Admin\AppData\Local\Temp\f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe
"C:\Users\Admin\AppData\Local\Temp\f9b7ef320dd7f76be9bdf12f14f0875a9f52165b989376cd1f2e2d23cdb52fe5.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\refwin\vA4sNR18kQc6zI2ZtXX8bQljrqc1PH.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\refwin\foc6vKUAZEY65yY4J20X1UEBMhV4Du.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\refwin\bMMmnU5Pk3Dd0eoAmVeK.exe
      bMMmnU5Pk3Dd0eoAmVeK.exe -p9ed828698aa0acda91423beb8959ab2ccd5b4535
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      Executes dropped EXE
      PID:4016
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\refwin\jAZtuqvf2eiSHwZHHDYGLTIVXS6GvD.vbe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\refwin\PeLWb1mhh1rUrsS4qjHxIlwkHIVgki.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\refwin\svcruntime.exe
        
        "C:\refwin\svcruntime.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads