64fa23f22cfa820eb89b80e1db1502fcaebcb66c1731e92f550c12ca940e8075

General

Target

onYLLDPXswyCVZu.exe
Size

1.0MB
MD5

1266b6b357e6126fcb5f8f2c509e668e
SHA1

e0404662e7cd00b331dd70bac3f14b38c60e7a68
SHA256

64fa23f22cfa820eb89b80e1db1502fcaebcb66c1731e92f550c12ca940e8075
SHA512

22883fa31c31e093bdc6d697815abe661d558403a53bceab14408129954251ff2cbee21ffec1a67924c94f57a86f104dbb5f2ed240117ba737d111ff97b2301b

Score

7^/10

spyware

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 checkip.dyndns.org
16 freegeoip.app
17 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

onYLLDPXswyCVZu.exe

description pid process target process

PID 508 set thread context of 416 508 onYLLDPXswyCVZu.exe onYLLDPXswyCVZu.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

204 schtasks.exe

flow	ioc
13	checkip.dyndns.org
16	freegeoip.app
17	freegeoip.app

description	pid	process	target process
PID 508 set thread context of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe

pid	process
204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

onYLLDPXswyCVZu.exe

pid	process
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe
416	onYLLDPXswyCVZu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

onYLLDPXswyCVZu.exe

description pid process

Token: SeDebugPrivilege 416 onYLLDPXswyCVZu.exe

description	pid	process
Token: SeDebugPrivilege	416	onYLLDPXswyCVZu.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

onYLLDPXswyCVZu.exe

description	pid	process	target process
PID 508 wrote to memory of 204	508	onYLLDPXswyCVZu.exe	schtasks.exe
PID 508 wrote to memory of 204	508	onYLLDPXswyCVZu.exe	schtasks.exe
PID 508 wrote to memory of 204	508	onYLLDPXswyCVZu.exe	schtasks.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe
PID 508 wrote to memory of 416	508	onYLLDPXswyCVZu.exe	onYLLDPXswyCVZu.exe

C:\Users\Admin\AppData\Local\Temp\onYLLDPXswyCVZu.exe
"C:\Users\Admin\AppData\Local\Temp\onYLLDPXswyCVZu.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pTeknAxJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB6.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:204
- C:\Users\Admin\AppData\Local\Temp\onYLLDPXswyCVZu.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\onYLLDPXswyCVZu.exe.log

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEB6.tmp

MD5
f01bea082cb939659f0ea6bbfc6dd794

SHA1
c3e9394e95e4e4b6ff997b908de99bb7d1112621

SHA256
0f2c10b67782552b52148b7dfafe52fd5c574ba735a7ca848788f364c3312d77

SHA512
840f0748cd1f00c7ddab9d30cb3bd1c21fd5348ea0d2525dba7fdb23b2c00510be1f1315d50bd5778947ebc14afa928063b2f181fab743210f8f2de36bdf3e7b

Download Submit
memory/204-11-0x0000000000000000-mapping.dmp

Download
memory/416-21-0x0000000006C90000-0x0000000006C91000-memory.dmp

Filesize
4KB

Download
memory/416-16-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/416-14-0x000000000046573E-mapping.dmp

Download
memory/416-13-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/508-6-0x0000000007540000-0x0000000007541000-memory.dmp

Filesize
4KB

Download
memory/508-10-0x0000000009B70000-0x0000000009B71000-memory.dmp

Filesize
4KB

Download
memory/508-9-0x0000000009A10000-0x0000000009AC5000-memory.dmp

Filesize
724KB

Download
memory/508-8-0x0000000007740000-0x000000000774E000-memory.dmp

Filesize
56KB

Download
memory/508-7-0x00000000074F0000-0x00000000074F1000-memory.dmp

Filesize
4KB

Download
memory/508-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/508-5-0x00000000079A0000-0x00000000079A1000-memory.dmp

Filesize
4KB

Download
memory/508-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads