f5d3f20a5e7fc84496267536833b84b4dce1c5cc168014215f396490c1430857

General

Target
AWfxqwWHtpJvgYx.exe
Size 1.0MB
Sample201008-4elf2f3mls
SHA256 f5d3f20a5e7fc84496267536833b84b4dce1c5cc168014215f396490c1430857
MD5 a763663ba47d847c1cf662ed7a0d483e
SHA1 7c231eb57d89759e2f16e6b2f2b82eb9e4bb575d
SHA512 496ceafd4a4af80fca495e501112ef791e4dd1f1bc640c00112e3a524c90701dc3d35daa24fb9166fa095171e531810ab594590c08a28c5986e3b430f780d408
MD5 SHA1 SHA512

Score

10^/10

spyware

Credentials

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\International\Geo\Nation	AWfxqwWHtpJvgYx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1332 set thread context of 1924	1332	AWfxqwWHtpJvgYx.exe	30

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1648	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1924	AWfxqwWHtpJvgYx.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	AWfxqwWHtpJvgYx.exe
Token: SeDebugPrivilege	1924	AWfxqwWHtpJvgYx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1924	AWfxqwWHtpJvgYx.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1648	1332	AWfxqwWHtpJvgYx.exe	28
PID 1332 wrote to memory of 1648	1332	AWfxqwWHtpJvgYx.exe	28
PID 1332 wrote to memory of 1648	1332	AWfxqwWHtpJvgYx.exe	28
PID 1332 wrote to memory of 1648	1332	AWfxqwWHtpJvgYx.exe	28
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30
PID 1332 wrote to memory of 1924	1332	AWfxqwWHtpJvgYx.exe	30

C:\Users\Admin\AppData\Local\Temp\AWfxqwWHtpJvgYx.exe
"C:\Users\Admin\AppData\Local\Temp\AWfxqwWHtpJvgYx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NcoJFE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBEAD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\AWfxqwWHtpJvgYx.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1924