28af95bea8456409bdb09856b0f46304eff9801c3c841b1362ca7a794d7628a5

General

Target
931fdd551975cf30ae02f85a90c5ee22.exe
Size 215KB
Sample201111-xt5bxz96ea
SHA256 28af95bea8456409bdb09856b0f46304eff9801c3c841b1362ca7a794d7628a5
MD5 931fdd551975cf30ae02f85a90c5ee22
SHA1 d0330b0199af3e6c06534fee5cbf9d5e88966bc1
SHA512 68b29d615d97e0be26d799390ba526b5959a805006f1294238073b980266e73b86b5f9a90948bd5170023b80b5d0141baa4784eb1a71b2036a7e36fdf8b71f32
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 4 IoCs

Loads dropped DLL 2 IoCs

pid	Process
1632	931fdd551975cf30ae02f85a90c5ee22.exe
1632	931fdd551975cf30ae02f85a90c5ee22.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1208	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1580	1632	931fdd551975cf30ae02f85a90c5ee22.exe	31
PID 1632 wrote to memory of 1580	1632	931fdd551975cf30ae02f85a90c5ee22.exe	31
PID 1632 wrote to memory of 1580	1632	931fdd551975cf30ae02f85a90c5ee22.exe	31
PID 1632 wrote to memory of 1580	1632	931fdd551975cf30ae02f85a90c5ee22.exe	31
PID 1632 wrote to memory of 1740	1632	931fdd551975cf30ae02f85a90c5ee22.exe	32
PID 1632 wrote to memory of 1740	1632	931fdd551975cf30ae02f85a90c5ee22.exe	32
PID 1632 wrote to memory of 1740	1632	931fdd551975cf30ae02f85a90c5ee22.exe	32
PID 1632 wrote to memory of 1740	1632	931fdd551975cf30ae02f85a90c5ee22.exe	32
PID 1740 wrote to memory of 1208	1740	cmd.exe	34
PID 1740 wrote to memory of 1208	1740	cmd.exe	34
PID 1740 wrote to memory of 1208	1740	cmd.exe	34
PID 1740 wrote to memory of 1208	1740	cmd.exe	34
PID 548 wrote to memory of 620	548	taskeng.exe	36
PID 548 wrote to memory of 620	548	taskeng.exe	36
PID 548 wrote to memory of 620	548	taskeng.exe	36
PID 548 wrote to memory of 620	548	taskeng.exe	36
PID 548 wrote to memory of 1968	548	taskeng.exe	37
PID 548 wrote to memory of 1968	548	taskeng.exe	37
PID 548 wrote to memory of 1968	548	taskeng.exe	37
PID 548 wrote to memory of 1968	548	taskeng.exe	37
PID 548 wrote to memory of 1584	548	taskeng.exe	38
PID 548 wrote to memory of 1584	548	taskeng.exe	38
PID 548 wrote to memory of 1584	548	taskeng.exe	38
PID 548 wrote to memory of 1584	548	taskeng.exe	38

C:\Users\Admin\AppData\Local\Temp\931fdd551975cf30ae02f85a90c5ee22.exe
"C:\Users\Admin\AppData\Local\Temp\931fdd551975cf30ae02f85a90c5ee22.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  "C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe"
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1208

C:\Windows\system32\taskeng.exe
taskeng.exe {00727168-A724-4494-888A-669FA25954FC} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  C:\Users\Admin\AppData\Local\Temp\bdalGDAA.exe
  2⤵
  - Executes dropped EXE
  PID:1584