0e2fce48323652f4be8408c1ab8b1565e40fe120f712127d2ab73c67167cce06

General

Target
6da5b9ccedaa30376ae4eaea0947546f.exe
Size 774KB
Sample210528-zzaecaz2px
SHA256 0e2fce48323652f4be8408c1ab8b1565e40fe120f712127d2ab73c67167cce06
MD5 6da5b9ccedaa30376ae4eaea0947546f
SHA1 eb702cb476d26dd8ad98316538af47964d7d2dc2
SHA512 e68a10a21776dc3ee89dc0eacfcbdbabbf5d50f2447307acbd22e85abdce40d64d873a30a01ac17c9fe4dc60513508647b8fe32e584859c465d1e6d5be7452a8
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1632	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com
5	api.ipify.org
6	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 308 set thread context of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1384	6da5b9ccedaa30376ae4eaea0947546f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	308	6da5b9ccedaa30376ae4eaea0947546f.exe
Token: SeDebugPrivilege	1384	6da5b9ccedaa30376ae4eaea0947546f.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 308 wrote to memory of 1384	308	6da5b9ccedaa30376ae4eaea0947546f.exe	29
PID 1384 wrote to memory of 1632	1384	6da5b9ccedaa30376ae4eaea0947546f.exe	31
PID 1384 wrote to memory of 1632	1384	6da5b9ccedaa30376ae4eaea0947546f.exe	31
PID 1384 wrote to memory of 1632	1384	6da5b9ccedaa30376ae4eaea0947546f.exe	31
PID 1384 wrote to memory of 1632	1384	6da5b9ccedaa30376ae4eaea0947546f.exe	31
PID 1632 wrote to memory of 1468	1632	cmd.exe	33
PID 1632 wrote to memory of 1468	1632	cmd.exe	33
PID 1632 wrote to memory of 1468	1632	cmd.exe	33
PID 1632 wrote to memory of 1468	1632	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\6da5b9ccedaa30376ae4eaea0947546f.exe
"C:\Users\Admin\AppData\Local\Temp\6da5b9ccedaa30376ae4eaea0947546f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308
- C:\Users\Admin\AppData\Local\Temp\6da5b9ccedaa30376ae4eaea0947546f.exe
  C:\Users\Admin\AppData\Local\Temp\6da5b9ccedaa30376ae4eaea0947546f.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "6da5b9ccedaa30376ae4eaea0947546f.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-60-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download

memory/308-62-0x00000000044F0000-0x0000000004573000-memory.dmp

Download

memory/308-63-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/308-64-0x0000000000410000-0x0000000000418000-memory.dmp

Download

memory/1384-65-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/1384-67-0x0000000000400000-0x0000000000544000-memory.dmp

Download

memory/1384-69-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads