6d9e623ecfe0a68e9240fb25a1b25d57b4c42dcf5dfcf0a73e414a1347046204

General

Target
grabbot_0.1.5.3.vir.exe
Size 280KB
Sample200719-v38mlqlfrs
SHA256 6d9e623ecfe0a68e9240fb25a1b25d57b4c42dcf5dfcf0a73e414a1347046204
MD5 ff4f8502939ff5e71705d7354fc8520e
SHA1 2e32fa6b3371b9efe82fccb58eb661162b0b4790
SHA512 dcb58d34eac4a80e4fc7c5c4f89c0ddfc941a3953863c8569ff662ead616bd6938d0fab1f5703f178a0dc8c2b64cd6fa30ecb497c4c220dfc2de34f55ac3c3fe
MD5 SHA1 SHA512

Score

7^/10

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 1436	1124	grabbot_0.1.5.3.vir.exe	24

Suspicious use of FindShellTrayWindow 5 IoCs

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1324	1124	grabbot_0.1.5.3.vir.exe	20
PID 1124 wrote to memory of 1324	1124	grabbot_0.1.5.3.vir.exe	20
PID 1124 wrote to memory of 1324	1124	grabbot_0.1.5.3.vir.exe	20
PID 1124 wrote to memory of 1436	1124	grabbot_0.1.5.3.vir.exe	24
PID 1124 wrote to memory of 1436	1124	grabbot_0.1.5.3.vir.exe	24
PID 1124 wrote to memory of 1436	1124	grabbot_0.1.5.3.vir.exe	24
PID 1124 wrote to memory of 1436	1124	grabbot_0.1.5.3.vir.exe	24
PID 1124 wrote to memory of 1436	1124	grabbot_0.1.5.3.vir.exe	24
PID 1124 wrote to memory of 1436	1124	grabbot_0.1.5.3.vir.exe	24

Deletes itself 1 IoCs

pid	Process
1324	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7ED18678-5840-DE00-1000-79A56C26F1} = "\"C:\\Users\\Admin\\AppData\\Roaming\\{7ED18678-5840-DE00-1000-79A56C26F1}\\pqvwcdinot.exe\""	Explorer.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE