a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc

General

Target

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe
Size

374KB
MD5

7a9f3d5d28718c039c591c3077b2be07
SHA1

bd07de2bcb53f2ad0fa3918827da9f2779f6500d
SHA256

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc
SHA512

107dbfba2150f35cb7eef5b030cb449ce1ea2ef073392cc7d02b671aacd4d066c1fd6c04d48740e024d523393f60755e893c722e43ff83249ef4991ae3370134

Score

8^/10

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe"	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

Loads dropped DLL 4 IoCs

Processes:

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

pid	process
676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe
676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe
676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe
676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

description	pid	process	target process
PID 676 wrote to memory of 784	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 784	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 784	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 784	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 1044	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 1044	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 1044	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 676 wrote to memory of 1044	676	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe

Executes dropped EXE 2 IoCs

Processes:

jfiag_gg.exejfiag_gg.exe

pid process

784 jfiag_gg.exe
1044 jfiag_gg.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
784	jfiag_gg.exe
1044	jfiag_gg.exe

flow	ioc
3	ip-api.com

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
2⤵
- Executes dropped EXE
PID:784

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
2⤵
- Executes dropped EXE
PID:1044