0beaf555e15749240f48b4fc85fa47dd97d9338d15e29d45bd65648343dbcbf4

General

Target

PT ARLISCO GROUP OF COMPANIES_xls.exe
Size

905KB
MD5

46b449ec0998c09ef3a4bd9e89dc7ba8
SHA1

972cb898f7a07e2cf219463711ed5cd34a5a4ca1
SHA256

0beaf555e15749240f48b4fc85fa47dd97d9338d15e29d45bd65648343dbcbf4
SHA512

54f30d6bcafe71c2c1dac6aa4d2184cd7934b9ed7a6bf6ea51dad5361ed475fc9ec286f4e900f87ab2c19082128cef89319ab48301b38eaf35c88aea4f163422

Score

7^/10

spyware

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3956	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3956	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	67
PID 3932 wrote to memory of 3956	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	67
PID 3932 wrote to memory of 3956	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	67
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69
PID 3932 wrote to memory of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 3312	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe	69

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	PT ARLISCO GROUP OF COMPANIES_xls.exe
Token: SeDebugPrivilege	3312	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3932	PT ARLISCO GROUP OF COMPANIES_xls.exe
3312	RegSvcs.exe
3312	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PT ARLISCO GROUP OF COMPANIES_xls.exe
"C:\Users\Admin\AppData\Local\Temp\PT ARLISCO GROUP OF COMPANIES_xls.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3932
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KGslxGbwBbXwuT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp848C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3956
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:3312