7b92f03c104ecded53f06eb45ea31c6eec767fa328e571b79cbd804631f49b85

Analysis

Target

injector.exe
Size

315KB
MD5

bd27acd9bc0ba05847dc0d8ea443e437
SHA1

151a2865819859e670a152409ae17ce8ce8f0200
SHA256

7b92f03c104ecded53f06eb45ea31c6eec767fa328e571b79cbd804631f49b85
SHA512

d2e8baa9177aa9e7e38d431594edc51f83bf75986876ccce83ea16263c4b58dc309e0b364e22c5a2476be5fbe90eec3972bbd00ed7cc0e9564c2b8ab54174876

Score

7^/10

spyware

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

injector.execmd.exe

description	pid	process	target process
PID 1496 wrote to memory of 1676	1496	injector.exe	cmd.exe
PID 1496 wrote to memory of 1676	1496	injector.exe	cmd.exe
PID 1496 wrote to memory of 1676	1496	injector.exe	cmd.exe
PID 1496 wrote to memory of 1676	1496	injector.exe	cmd.exe
PID 1676 wrote to memory of 1812	1676	cmd.exe	PING.EXE
PID 1676 wrote to memory of 1812	1676	cmd.exe	PING.EXE
PID 1676 wrote to memory of 1812	1676	cmd.exe	PING.EXE
PID 1676 wrote to memory of 1812	1676	cmd.exe	PING.EXE

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1676 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1812 PING.EXE

pid	process
1676	cmd.exe

pid	process
1812	PING.EXE

C:\Users\Admin\AppData\Local\Temp\injector.exe
"C:\Users\Admin\AppData\Local\Temp\injector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 1000
3⤵
- Runs ping.exe
PID:1812

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Remote System Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact