39b5fce9392c62ee6d0fc38f2d7b4b2e67b969a554e20619a2266d1229649ad3

General

Target
SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe
Size 392KB
Sample200716-15ywhxstb2
SHA256 39b5fce9392c62ee6d0fc38f2d7b4b2e67b969a554e20619a2266d1229649ad3
MD5 a92d2133b7fde5a80d10d0d97d16a0df
SHA1 a2b3a2feb6430a3fbc42f301f7d1d22b2b69ee60
SHA512 3981b8dfe5a642591b01d0c6b93bf4be32ff0d3a89832a1101b47ee7c12a77a7549e88439dfd5e336614e31555f2e03122646d6aaee726b106fa1bc233cfdde7
MD5 SHA1 SHA512

Score

7^/10

spyware

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2712	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	71
PID 2916 wrote to memory of 2712	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	71
PID 2916 wrote to memory of 2712	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	71
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73
PID 2916 wrote to memory of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 3596	2916	SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe	73

Loads dropped DLL 6 IoCs

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad5f-12.dat	js

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2712	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.CAP_HookExKeylogger.22198.23907.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:2916
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ywwPJhmw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp119A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  PID:3596