2f40f4d8e5fd1aeb0510e07f954f0f22f6d0e6644bae21bfcd5b913696c158cb

General

Target
323bf86aeeab08e1388d51cffc172f53.exe
Size 207KB
Sample201111-xefe85p4ds
SHA256 2f40f4d8e5fd1aeb0510e07f954f0f22f6d0e6644bae21bfcd5b913696c158cb
MD5 323bf86aeeab08e1388d51cffc172f53
SHA1 aab75fca715cd3bfb03782c0d4d9b9a28e6f22d1
SHA512 6b1b2ebbba3498a5e86ef9135398f5f2c1c48d65ca41319b851ee76d7d755e21ea1d44d13acf42efe127e327a342a3c1a89e7952c2aca3e528656d39a6ccf1d9
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 4 IoCs

Loads dropped DLL 2 IoCs

pid	Process
1664	323bf86aeeab08e1388d51cffc172f53.exe
1664	323bf86aeeab08e1388d51cffc172f53.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1496	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 968	1664	323bf86aeeab08e1388d51cffc172f53.exe	31
PID 1664 wrote to memory of 968	1664	323bf86aeeab08e1388d51cffc172f53.exe	31
PID 1664 wrote to memory of 968	1664	323bf86aeeab08e1388d51cffc172f53.exe	31
PID 1664 wrote to memory of 968	1664	323bf86aeeab08e1388d51cffc172f53.exe	31
PID 1664 wrote to memory of 1088	1664	323bf86aeeab08e1388d51cffc172f53.exe	32
PID 1664 wrote to memory of 1088	1664	323bf86aeeab08e1388d51cffc172f53.exe	32
PID 1664 wrote to memory of 1088	1664	323bf86aeeab08e1388d51cffc172f53.exe	32
PID 1664 wrote to memory of 1088	1664	323bf86aeeab08e1388d51cffc172f53.exe	32
PID 1088 wrote to memory of 1496	1088	cmd.exe	34
PID 1088 wrote to memory of 1496	1088	cmd.exe	34
PID 1088 wrote to memory of 1496	1088	cmd.exe	34
PID 1088 wrote to memory of 1496	1088	cmd.exe	34
PID 952 wrote to memory of 988	952	taskeng.exe	36
PID 952 wrote to memory of 988	952	taskeng.exe	36
PID 952 wrote to memory of 988	952	taskeng.exe	36
PID 952 wrote to memory of 988	952	taskeng.exe	36
PID 952 wrote to memory of 308	952	taskeng.exe	37
PID 952 wrote to memory of 308	952	taskeng.exe	37
PID 952 wrote to memory of 308	952	taskeng.exe	37
PID 952 wrote to memory of 308	952	taskeng.exe	37
PID 952 wrote to memory of 2032	952	taskeng.exe	38
PID 952 wrote to memory of 2032	952	taskeng.exe	38
PID 952 wrote to memory of 2032	952	taskeng.exe	38
PID 952 wrote to memory of 2032	952	taskeng.exe	38

C:\Users\Admin\AppData\Local\Temp\323bf86aeeab08e1388d51cffc172f53.exe
"C:\Users\Admin\AppData\Local\Temp\323bf86aeeab08e1388d51cffc172f53.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  "C:\Users\Admin\AppData\Local\Temp\hDKilald.exe"
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\hDKilald.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\hDKilald.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1496

C:\Windows\system32\taskeng.exe
taskeng.exe {D0D5EBF6-1771-4DEF-81C5-BAB0AFE553B4} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  C:\Users\Admin\AppData\Local\Temp\hDKilald.exe
  2⤵
  - Executes dropped EXE
  PID:2032