ebee6aa23581694ef24a432fd0e09a5b150e9238f973ec62d182d6ca8c0b07e9

General

Target

Specifications_Details_20330_FLQ.exe
Size

799KB
MD5

edbb2066fd9539e279bf48077b755a40
SHA1

f914783d5d5aeeb95eda30a8c456624e471108a2
SHA256

41f206a7e8b3c15642e6cfad479ae3f0972b82e57ec46a5ffd31e51954a81c6c
SHA512

8c9fa977b79afbbe9a49f0bb3ee93479f4bb4b44211fac8c87beae2e8ca917c0c3be783ce6a0d1e268bf92b2ddd893454a86d13c95a732896206429e5cc98862

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Specifications_Details_20330_FLQ.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\notepad\\notepad.exe\""	Specifications_Details_20330_FLQ.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 checkip.dyndns.org
18 freegeoip.app
19 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Specifications_Details_20330_FLQ.exe

description pid process target process

PID 664 set thread context of 3460 664 Specifications_Details_20330_FLQ.exe Specifications_Details_20330_FLQ.exe

flow	ioc
15	checkip.dyndns.org
18	freegeoip.app
19	freegeoip.app

description	pid	process	target process
PID 664 set thread context of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

Specifications_Details_20330_FLQ.exeSpecifications_Details_20330_FLQ.exe

pid	process
664	Specifications_Details_20330_FLQ.exe
664	Specifications_Details_20330_FLQ.exe
664	Specifications_Details_20330_FLQ.exe
664	Specifications_Details_20330_FLQ.exe
664	Specifications_Details_20330_FLQ.exe
664	Specifications_Details_20330_FLQ.exe
3460	Specifications_Details_20330_FLQ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Specifications_Details_20330_FLQ.exeSpecifications_Details_20330_FLQ.exe

description pid process

Token: SeDebugPrivilege 664 Specifications_Details_20330_FLQ.exe
Token: SeDebugPrivilege 3460 Specifications_Details_20330_FLQ.exe

description	pid	process
Token: SeDebugPrivilege	664	Specifications_Details_20330_FLQ.exe
Token: SeDebugPrivilege	3460	Specifications_Details_20330_FLQ.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Specifications_Details_20330_FLQ.exe

description	pid	process	target process
PID 664 wrote to memory of 4060	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 4060	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 4060	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 664 wrote to memory of 3460	664	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe

C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
"C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
  C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
  C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Specifications_Details_20330_FLQ.exe.log

MD5
9e7845217df4a635ec4341c3d52ed685

SHA1
d65cb39d37392975b038ce503a585adadb805da5

SHA256
d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

SHA512
307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

Download Submit
memory/664-118-0x0000000005800000-0x0000000005CFE000-memory.dmp

Filesize
5.0MB

Download
memory/664-117-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/664-114-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/664-119-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/664-120-0x0000000007270000-0x00000000072D8000-memory.dmp

Filesize
416KB

Download
memory/664-125-0x0000000007B00000-0x0000000007B7B000-memory.dmp

Filesize
492KB

Download
memory/664-116-0x0000000005D00000-0x0000000005D01000-memory.dmp

Filesize
4KB

Download
memory/3460-126-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3460-127-0x00000000004490BE-mapping.dmp

Download
memory/3460-132-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/3460-133-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/3460-134-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Filesize
4KB

Download
memory/3460-136-0x0000000006340000-0x0000000006341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads