5cc38d4a28e3609654ae3975d062a71272bdaaa655d998498f2169c7679bb19e

General

Target

09000000000000h.exe
Size

593KB
MD5

af891ae0d2ec4596cd000335cfb9bbcc
SHA1

bc5414af0bf6cabe07b0088a306a06f6f3dd5407
SHA256

5cc38d4a28e3609654ae3975d062a71272bdaaa655d998498f2169c7679bb19e
SHA512

7d8d2aad1499609e9ff3b0c503a24926cc8ce1f71b1e34b17b7d2e7f6940dbd49caa72ccbd2fa93baf078b2df9e7928d11e0375b751a4e98e544955cc9dd2335

Score

7^/10

spyware

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe	Powershell.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 checkip.dyndns.org
13 freegeoip.app
14 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

09000000000000h.exe

description pid process target process

PID 508 set thread context of 4076 508 09000000000000h.exe 09000000000000h.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exe09000000000000h.exe

pid process

3140 Powershell.exe
4076 09000000000000h.exe
3140 Powershell.exe
3140 Powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Powershell.exe09000000000000h.exe

description pid process

Token: SeDebugPrivilege 3140 Powershell.exe
Token: SeDebugPrivilege 4076 09000000000000h.exe

flow	ioc
10	checkip.dyndns.org
13	freegeoip.app
14	freegeoip.app

description	pid	process	target process
PID 508 set thread context of 4076	508	09000000000000h.exe	09000000000000h.exe

pid	process
3140	Powershell.exe
4076	09000000000000h.exe
3140	Powershell.exe
3140	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	3140	Powershell.exe
Token: SeDebugPrivilege	4076	09000000000000h.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

09000000000000h.exe

description	pid	process	target process
PID 508 wrote to memory of 3140	508	09000000000000h.exe	Powershell.exe
PID 508 wrote to memory of 3140	508	09000000000000h.exe	Powershell.exe
PID 508 wrote to memory of 3140	508	09000000000000h.exe	Powershell.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe
PID 508 wrote to memory of 4076	508	09000000000000h.exe	09000000000000h.exe

C:\Users\Admin\AppData\Local\Temp\09000000000000h.exe
"C:\Users\Admin\AppData\Local\Temp\09000000000000h.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\09000000000000h.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Users\Admin\AppData\Local\Temp\09000000000000h.exe
"C:\Users\Admin\AppData\Local\Temp\09000000000000h.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-15-0x0000000008AA0000-0x0000000008AAF000-memory.dmp

Filesize
60KB

Download
memory/508-5-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/508-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/508-6-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/508-7-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/508-8-0x00000000086A0000-0x0000000008731000-memory.dmp

Filesize
580KB

Download
memory/508-9-0x0000000008740000-0x0000000008741000-memory.dmp

Filesize
4KB

Download
memory/508-10-0x0000000008B40000-0x0000000008B41000-memory.dmp

Filesize
4KB

Download
memory/508-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/3140-13-0x0000000004210000-0x0000000004211000-memory.dmp

Filesize
4KB

Download
memory/3140-30-0x0000000007D20000-0x0000000007D21000-memory.dmp

Filesize
4KB

Download
memory/3140-12-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/3140-35-0x0000000008A50000-0x0000000008A51000-memory.dmp

Filesize
4KB

Download
memory/3140-14-0x0000000006C70000-0x0000000006C71000-memory.dmp

Filesize
4KB

Download
memory/3140-23-0x0000000007380000-0x0000000007381000-memory.dmp

Filesize
4KB

Download
memory/3140-34-0x00000000089E0000-0x00000000089E1000-memory.dmp

Filesize
4KB

Download
memory/3140-27-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/3140-25-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/3140-11-0x0000000000000000-mapping.dmp

Download
memory/3140-33-0x0000000008AC0000-0x0000000008AC1000-memory.dmp

Filesize
4KB

Download
memory/3140-28-0x0000000007A80000-0x0000000007A81000-memory.dmp

Filesize
4KB

Download
memory/3140-24-0x0000000007520000-0x0000000007521000-memory.dmp

Filesize
4KB

Download
memory/4076-29-0x0000000006690000-0x0000000006691000-memory.dmp

Filesize
4KB

Download
memory/4076-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4076-18-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4076-17-0x000000000046471E-mapping.dmp

Download

Analysis

Sharing