41f206a7e8b3c15642e6cfad479ae3f0972b82e57ec46a5ffd31e51954a81c6c

General

Target

Specifications_Details_20330_FLQ.exe
Size

799KB
MD5

edbb2066fd9539e279bf48077b755a40
SHA1

f914783d5d5aeeb95eda30a8c456624e471108a2
SHA256

41f206a7e8b3c15642e6cfad479ae3f0972b82e57ec46a5ffd31e51954a81c6c
SHA512

8c9fa977b79afbbe9a49f0bb3ee93479f4bb4b44211fac8c87beae2e8ca917c0c3be783ce6a0d1e268bf92b2ddd893454a86d13c95a732896206429e5cc98862

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Specifications_Details_20330_FLQ.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\notepad\\notepad.exe\""	Specifications_Details_20330_FLQ.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 checkip.dyndns.org
18 freegeoip.app
19 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Specifications_Details_20330_FLQ.exe

description pid process target process

PID 740 set thread context of 1540 740 Specifications_Details_20330_FLQ.exe Specifications_Details_20330_FLQ.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Specifications_Details_20330_FLQ.exeSpecifications_Details_20330_FLQ.exe

pid process

740 Specifications_Details_20330_FLQ.exe
740 Specifications_Details_20330_FLQ.exe
1540 Specifications_Details_20330_FLQ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Specifications_Details_20330_FLQ.exeSpecifications_Details_20330_FLQ.exe

description pid process

Token: SeDebugPrivilege 740 Specifications_Details_20330_FLQ.exe
Token: SeDebugPrivilege 1540 Specifications_Details_20330_FLQ.exe

flow	ioc
15	checkip.dyndns.org
18	freegeoip.app
19	freegeoip.app

description	pid	process	target process
PID 740 set thread context of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe

pid	process
740	Specifications_Details_20330_FLQ.exe
740	Specifications_Details_20330_FLQ.exe
1540	Specifications_Details_20330_FLQ.exe

description	pid	process
Token: SeDebugPrivilege	740	Specifications_Details_20330_FLQ.exe
Token: SeDebugPrivilege	1540	Specifications_Details_20330_FLQ.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Specifications_Details_20330_FLQ.exe

description	pid	process	target process
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe
PID 740 wrote to memory of 1540	740	Specifications_Details_20330_FLQ.exe	Specifications_Details_20330_FLQ.exe

C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
"C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
  C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20330_FLQ.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Specifications_Details_20330_FLQ.exe.log

MD5
9e7845217df4a635ec4341c3d52ed685

SHA1
d65cb39d37392975b038ce503a585adadb805da5

SHA256
d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

SHA512
307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

Download Submit
memory/740-118-0x0000000005170000-0x000000000566E000-memory.dmp

Filesize
5.0MB

Download
memory/740-117-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/740-119-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/740-120-0x0000000006CE0000-0x0000000006D48000-memory.dmp

Filesize
416KB

Download
memory/740-125-0x00000000075E0000-0x000000000765B000-memory.dmp

Filesize
492KB

Download
memory/740-116-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/1540-126-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1540-127-0x00000000004490BE-mapping.dmp

Download
memory/1540-132-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1540-133-0x0000000005680000-0x0000000005B7E000-memory.dmp

Filesize
5.0MB

Download
memory/1540-134-0x00000000068B0000-0x00000000068B1000-memory.dmp

Filesize
4KB

Download
memory/1540-136-0x0000000006C30000-0x0000000006C31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing