2d7abc6173feb17ef4223fc045f35ed18607680b1844dfffcba70351d92626ce

General

Target
3f382731e5660d71a96011a8e3574bc6.exe
Size 500KB
Sample210723-mn9k2e8drx
SHA256 2d7abc6173feb17ef4223fc045f35ed18607680b1844dfffcba70351d92626ce
MD5 3f382731e5660d71a96011a8e3574bc6
SHA1 80a2e18cdbcd572d24ffd167015a7e895d0c5c78
SHA512 3f9c4ccae69bd13872fa93f10e990bc41105f8c535601c7ece211f75e2e32ee2d3104e9814de01b11361da9c416020a898329d7f64f3e66fdd165ac8a6e2403a
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
4192	Q6qdDruLjv.exe
908	sqlcmd.exe

Loads dropped DLL 5 IoCs

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
492	schtasks.exe
408	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2668	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4192	4648	3f382731e5660d71a96011a8e3574bc6.exe	78
PID 4648 wrote to memory of 4192	4648	3f382731e5660d71a96011a8e3574bc6.exe	78
PID 4648 wrote to memory of 4192	4648	3f382731e5660d71a96011a8e3574bc6.exe	78
PID 4648 wrote to memory of 4184	4648	3f382731e5660d71a96011a8e3574bc6.exe	79
PID 4648 wrote to memory of 4184	4648	3f382731e5660d71a96011a8e3574bc6.exe	79
PID 4648 wrote to memory of 4184	4648	3f382731e5660d71a96011a8e3574bc6.exe	79
PID 4184 wrote to memory of 2668	4184	cmd.exe	81
PID 4184 wrote to memory of 2668	4184	cmd.exe	81
PID 4184 wrote to memory of 2668	4184	cmd.exe	81
PID 4192 wrote to memory of 492	4192	Q6qdDruLjv.exe	82
PID 4192 wrote to memory of 492	4192	Q6qdDruLjv.exe	82
PID 4192 wrote to memory of 492	4192	Q6qdDruLjv.exe	82
PID 908 wrote to memory of 408	908	sqlcmd.exe	85
PID 908 wrote to memory of 408	908	sqlcmd.exe	85
PID 908 wrote to memory of 408	908	sqlcmd.exe	85

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
  2⤵
  - Creates scheduled task(s)
  PID:408