7ca2e77373e52431f89441df57949f8ed73f5d3cf5873f964b4c00446770d5fe

General

Target
P.O-00490585693.pdf.exe
Size 570KB
Sample201015-yxlasass4x
SHA256 7ca2e77373e52431f89441df57949f8ed73f5d3cf5873f964b4c00446770d5fe
MD5 d9d9b12977e4df98046692a0a47d4ca9
SHA1 2d5c0fbf770c944443d52a2b0088e9077001838d
SHA512 f055dfd784ff1e346d6a4fa759f0e38b1fb80c8086f9b306c7b53eb14e7e2af627fe41eee892d1e5cf2a7f3a2e2801dfbad5fcadf1b69a1b3e56daa505573d0f
MD5 SHA1 SHA512

Score

10^/10

spyware

Credentials

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 1896	2460	P.O-00490585693.pdf.exe	78

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2460	P.O-00490585693.pdf.exe
1896	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1896	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	P.O-00490585693.pdf.exe
Token: SeDebugPrivilege	1896	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1532	2460	P.O-00490585693.pdf.exe	76
PID 2460 wrote to memory of 1532	2460	P.O-00490585693.pdf.exe	76
PID 2460 wrote to memory of 1532	2460	P.O-00490585693.pdf.exe	76
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78
PID 2460 wrote to memory of 1896	2460	P.O-00490585693.pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\P.O-00490585693.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\P.O-00490585693.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oJRcDllTRTGck" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA74D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1532
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1896