df4402ea60ec3926d41fcf1256598ac8205de716bc03f6740a7a5245965c2fb3

General

Target
w3ZunC4T3NabRBY.exe
Size 714KB
Sample200720-c61q343eb2
SHA256 df4402ea60ec3926d41fcf1256598ac8205de716bc03f6740a7a5245965c2fb3
MD5 6186934d6ebcbd2761413698113233cf
SHA1 1cb707da74be05966780ee846a83971a68a38775
SHA512 6c8770bfaa7b43d3266e68e06b2ad112a1866362a8a5b1c3c4ccc085d0cbd25ef4515d503bcf0db886e860ddbe4239ee045ffa0e574a3584d454045c97b860cc
MD5 SHA1 SHA512

Score

7^/10

spyware

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1816	1360	w3ZunC4T3NabRBY.exe	26
PID 1360 wrote to memory of 1816	1360	w3ZunC4T3NabRBY.exe	26
PID 1360 wrote to memory of 1816	1360	w3ZunC4T3NabRBY.exe	26
PID 1360 wrote to memory of 1816	1360	w3ZunC4T3NabRBY.exe	26
PID 1360 wrote to memory of 1736	1360	w3ZunC4T3NabRBY.exe	28
PID 1360 wrote to memory of 1736	1360	w3ZunC4T3NabRBY.exe	28
PID 1360 wrote to memory of 1736	1360	w3ZunC4T3NabRBY.exe	28
PID 1360 wrote to memory of 1736	1360	w3ZunC4T3NabRBY.exe	28
PID 1360 wrote to memory of 1852	1360	w3ZunC4T3NabRBY.exe	29
PID 1360 wrote to memory of 1852	1360	w3ZunC4T3NabRBY.exe	29
PID 1360 wrote to memory of 1852	1360	w3ZunC4T3NabRBY.exe	29
PID 1360 wrote to memory of 1852	1360	w3ZunC4T3NabRBY.exe	29
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30
PID 1360 wrote to memory of 1760	1360	w3ZunC4T3NabRBY.exe	30

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	w3ZunC4T3NabRBY.exe
Token: SeDebugPrivilege	1760	w3ZunC4T3NabRBY.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 1760	1360	w3ZunC4T3NabRBY.exe	30

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1816	schtasks.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\w3ZunC4T3NabRBY.exe
"C:\Users\Admin\AppData\Local\Temp\w3ZunC4T3NabRBY.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1360
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QSKLGEXGxHpYN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2838.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1816
- C:\Users\Admin\AppData\Local\Temp\w3ZunC4T3NabRBY.exe
  "{path}"
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\w3ZunC4T3NabRBY.exe
  "{path}"
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\w3ZunC4T3NabRBY.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1760