64fa23f22cfa820eb89b80e1db1502fcaebcb66c1731e92f550c12ca940e8075

General

Target

onYLLDPXswyCVZu.exe
Size

1.0MB
MD5

1266b6b357e6126fcb5f8f2c509e668e
SHA1

e0404662e7cd00b331dd70bac3f14b38c60e7a68
SHA256

64fa23f22cfa820eb89b80e1db1502fcaebcb66c1731e92f550c12ca940e8075
SHA512

22883fa31c31e093bdc6d697815abe661d558403a53bceab14408129954251ff2cbee21ffec1a67924c94f57a86f104dbb5f2ed240117ba737d111ff97b2301b

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 freegeoip.app
6 checkip.dyndns.org
11 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

onYLLDPXswyCVZu.exe

description pid process target process

PID 1080 set thread context of 756 1080 onYLLDPXswyCVZu.exe onYLLDPXswyCVZu.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1744 schtasks.exe

flow	ioc
12	freegeoip.app
6	checkip.dyndns.org
11	freegeoip.app

description	pid	process	target process
PID 1080 set thread context of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe

pid	process
1744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

onYLLDPXswyCVZu.exe

pid	process
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe
756	onYLLDPXswyCVZu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

onYLLDPXswyCVZu.exe

description pid process

Token: SeDebugPrivilege 756 onYLLDPXswyCVZu.exe

description	pid	process
Token: SeDebugPrivilege	756	onYLLDPXswyCVZu.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

onYLLDPXswyCVZu.exe

description	pid	process	target process
PID 1080 wrote to memory of 1744	1080	onYLLDPXswyCVZu.exe	schtasks.exe
PID 1080 wrote to memory of 1744	1080	onYLLDPXswyCVZu.exe	schtasks.exe
PID 1080 wrote to memory of 1744	1080	onYLLDPXswyCVZu.exe	schtasks.exe
PID 1080 wrote to memory of 1744	1080	onYLLDPXswyCVZu.exe	schtasks.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 1080 wrote to memory of 756	1080	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe

C:\Users\Admin\AppData\Local\Temp\onYLLDPXswyCVZu.exe
"C:\Users\Admin\AppData\Local\Temp\onYLLDPXswyCVZu.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pTeknAxJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB63.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\onYLLDPXswyCVZu.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBB63.tmp

MD5
0f95123fa8163b80e715d1aa5a04a627

SHA1
675ddc09da53559313b401b98ec6fadbc6dc3968

SHA256
60e4555ec1dac31adf58c4f7a95edba993d10f513cc57231f2bd9e363375c848

SHA512
aea949c89686cb33fbba318efc5b054fda6eca1cb8dc8d0d3da5d20c312465585c1e40ce006d61d93e240b1757c436cfb639279f4a03cbbe4ceed7996ddfb83b

Download Submit
memory/756-9-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/756-10-0x000000000046573E-mapping.dmp

Download
memory/756-11-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/756-12-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/756-13-0x0000000074C70000-0x000000007535E000-memory.dmp

Filesize
6.9MB

Download
memory/1080-2-0x0000000074CF0000-0x00000000753DE000-memory.dmp

Filesize
6.9MB

Download
memory/1080-3-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1080-5-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/1080-6-0x0000000000540000-0x00000000005F5000-memory.dmp

Filesize
724KB

Download
memory/1744-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads