5e3e18d13dfbde5f8842816a37d596a5c0ef499cadd7b96db278688758c8ebf7

General

Target

PO# TTL-0509189..exe
Size

841KB
MD5

986ed6658f8c04e39b2889c7928db861
SHA1

f933f7ce1f277b3b7b7f3948d87d278cd830d620
SHA256

5e3e18d13dfbde5f8842816a37d596a5c0ef499cadd7b96db278688758c8ebf7
SHA512

0fd6ce3876bb1b332a3ee4232cc6bc8e8f3ea5f098fd8b27b25e707be39139dfa868470329417b958bd85952ee11af34306aa0a17742d2b426682fb0e8813904

Score

10^/10

spyware

Credentials

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 4092	1628	PO# TTL-0509189..exe	72
PID 1628 wrote to memory of 4092	1628	PO# TTL-0509189..exe	72
PID 1628 wrote to memory of 4092	1628	PO# TTL-0509189..exe	72
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74
PID 1628 wrote to memory of 4048	1628	PO# TTL-0509189..exe	74

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 4048	1628	PO# TTL-0509189..exe	74

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	PO# TTL-0509189..exe
Token: SeDebugPrivilege	4048	PO# TTL-0509189..exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4092	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PO# TTL-0509189..exe
"C:\Users\Admin\AppData\Local\Temp\PO# TTL-0509189..exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1628
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xDVkKbrhxGBsW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8C9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4092
- C:\Users\Admin\AppData\Local\Temp\PO# TTL-0509189..exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:4048