cd2b2d05e9154852f77c8377ee83f620951e47047bb702e026690508fee44416

Analysis

Target
NOAH NEW_crypted.exe
Size 433KB
Sample200923-e3gvkghwb2
SHA256 cd2b2d05e9154852f77c8377ee83f620951e47047bb702e026690508fee44416
MD5 7b8733d6babeb5f8b5208eeba854b7e5
SHA1 7070e6394d715d9a5a2164a4fe9026af0a2d123e
SHA512 6bff791e8c83d607ef9b842cd0ae949cd7f74c57cfb22257014bc23c05e575462d81ab801fa0d8a624aad730debe59912b9cf8bf984c08fb5b0f028bb77afebb
MD5 SHA1 SHA512

Score

7^/10

spyware

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3888 set thread context of 2140	3888	NOAH NEW_crypted.exe	76

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3888	NOAH NEW_crypted.exe
Token: SeDebugPrivilege	2140	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 2100	3888	NOAH NEW_crypted.exe	75
PID 3888 wrote to memory of 2100	3888	NOAH NEW_crypted.exe	75
PID 3888 wrote to memory of 2100	3888	NOAH NEW_crypted.exe	75
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76
PID 3888 wrote to memory of 2140	3888	NOAH NEW_crypted.exe	76

C:\Users\Admin\AppData\Local\Temp\NOAH NEW_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\NOAH NEW_crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2140-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download