d24e4acfbe8cc67f262b4f6fd53cab9c202ce8d43337ae051152384453e3df3d

General

Target
68d2139e5201ceddf36b35d25b8688ce.exe
Size 598KB
Sample200729-j3srazn4ve
SHA256 d24e4acfbe8cc67f262b4f6fd53cab9c202ce8d43337ae051152384453e3df3d
MD5 68d2139e5201ceddf36b35d25b8688ce
SHA1 29fc0bdecfe94ca3aa19cf71fe63153e63a95ea0
SHA512 1e6ad5057e688cf931c401b6cff2d93902e67c09922c8e694c84b713704b2bd3a2915304f171e147a5f1c6492c068a5245c1b8efb23cc3a616aaf44706b82b06
MD5 SHA1 SHA512

Score

7^/10

spyware

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	68d2139e5201ceddf36b35d25b8688ce.exe
Token: SeDebugPrivilege	3852	68d2139e5201ceddf36b35d25b8688ce.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4016	408	68d2139e5201ceddf36b35d25b8688ce.exe	73
PID 408 wrote to memory of 4016	408	68d2139e5201ceddf36b35d25b8688ce.exe	73
PID 408 wrote to memory of 4016	408	68d2139e5201ceddf36b35d25b8688ce.exe	73
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75
PID 408 wrote to memory of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 408 set thread context of 3852	408	68d2139e5201ceddf36b35d25b8688ce.exe	75

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
4016	schtasks.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3852	68d2139e5201ceddf36b35d25b8688ce.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\68d2139e5201ceddf36b35d25b8688ce.exe
"C:\Users\Admin\AppData\Local\Temp\68d2139e5201ceddf36b35d25b8688ce.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:408
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\&startupname&" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B26.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4016
- C:\Users\Admin\AppData\Local\Temp\68d2139e5201ceddf36b35d25b8688ce.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3852