a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a

General

Target

a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
Size

1.6MB
MD5

aa1101d3c7afdb51d8520ead1e690c9a
SHA1

f385e25cbc51dd820a87f9c0f4618a9e92f4090b
SHA256

a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a
SHA512

3671850bad614f34d6e6f818e4fdb15b7651b121c264758e083796aed957d008982b5605b9e5ac33512641c510ac568e073e0ea9214f92577ae8c53aaf4fbf98

Score

8^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3860	1468	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe	72
PID 1468 wrote to memory of 3860	1468	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe	72
PID 1468 wrote to memory of 3860	1468	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe	72

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\ReceiveOptimize.pot.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\UseSwitch.jpeg.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\DebugUpdate.svg.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\EnterStop.dotm.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\SetCheckpoint.svg.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\StopSelect.dotx.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\SyncSend.png.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\UnpublishTrace.xltx.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\UseClose.jpg.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Program Files\WriteSend.zip.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\ResizeInitialize.tiff.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Users\Admin\Pictures\UninstallStop.raw.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Users\Admin\Pictures\UseDisable.tiff.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Users\Admin\Pictures\EnableResize.tiff.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
File created	C:\Users\Admin\Pictures\OptimizeUninstall.tif.Sil3nt5pring	a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe

C:\Users\Admin\AppData\Local\Temp\a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\a0fa26c2f79fd4e0f3f25b3fcb7aa02bb0194b34f13aa8d721b114432a00b05a.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Modifies extensions of user files
PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:3860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact