a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc

General

Target

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe
Size

374KB
MD5

7a9f3d5d28718c039c591c3077b2be07
SHA1

bd07de2bcb53f2ad0fa3918827da9f2779f6500d
SHA256

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc
SHA512

107dbfba2150f35cb7eef5b030cb449ce1ea2ef073392cc7d02b671aacd4d066c1fd6c04d48740e024d523393f60755e893c722e43ff83249ef4991ae3370134

Score

8^/10

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

description	pid	process	target process
PID 2880 wrote to memory of 3224	2880	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 2880 wrote to memory of 3224	2880	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 2880 wrote to memory of 3224	2880	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 2880 wrote to memory of 3948	2880	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 2880 wrote to memory of 3948	2880	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe
PID 2880 wrote to memory of 3948	2880	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe	jfiag_gg.exe

Executes dropped EXE 2 IoCs

Processes:

jfiag_gg.exejfiag_gg.exe

pid process

3224 jfiag_gg.exe
3948 jfiag_gg.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jfiag_gg.exe

pid process

3948 jfiag_gg.exe
3948 jfiag_gg.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3224	jfiag_gg.exe
3948	jfiag_gg.exe

pid	process
3948	jfiag_gg.exe
3948	jfiag_gg.exe

flow	ioc
2	ip-api.com

Adds Run entry to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe"	a6964b245e70a97f8633616ede2122a72b6e159a70874beb1d8b3aba26b510dc.exe

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
2⤵
- Executes dropped EXE
PID:3224