e024cdc86e86ed70ee832fa2b123cf89c6c78bac46337e2738b12b2b03399661

General

Target
3e27de3882e7243f71c7ac2df3de2be4.exe
Size 493KB
Sample210724-aa7pnswt9e
SHA256 e024cdc86e86ed70ee832fa2b123cf89c6c78bac46337e2738b12b2b03399661
MD5 3e27de3882e7243f71c7ac2df3de2be4
SHA1 733b956aa60d07e60809764037bcca854b01e73f
SHA512 c1e6259e6fa92bfb98e0ef9566083d39a9e2451586e375599163b8e09e5189c197dbaedfc5092b7f0ec2a7b116667a4bd9e4deb72f99d6d550c9787f8a5e142d
MD5 SHA1 SHA512

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
856	Olf0BxIaEk.exe
1556	sqlcmd.exe

Deletes itself 1 IoCs

pid	Process
1332	cmd.exe

Loads dropped DLL 9 IoCs

pid	Process
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe
1096	3e27de3882e7243f71c7ac2df3de2be4.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
512	schtasks.exe
292	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
812	timeout.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	3e27de3882e7243f71c7ac2df3de2be4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	3e27de3882e7243f71c7ac2df3de2be4.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 856	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	30
PID 1096 wrote to memory of 856	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	30
PID 1096 wrote to memory of 856	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	30
PID 1096 wrote to memory of 856	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	30
PID 1096 wrote to memory of 1332	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	31
PID 1096 wrote to memory of 1332	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	31
PID 1096 wrote to memory of 1332	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	31
PID 1096 wrote to memory of 1332	1096	3e27de3882e7243f71c7ac2df3de2be4.exe	31
PID 1332 wrote to memory of 812	1332	cmd.exe	33
PID 1332 wrote to memory of 812	1332	cmd.exe	33
PID 1332 wrote to memory of 812	1332	cmd.exe	33
PID 1332 wrote to memory of 812	1332	cmd.exe	33
PID 856 wrote to memory of 512	856	Olf0BxIaEk.exe	34
PID 856 wrote to memory of 512	856	Olf0BxIaEk.exe	34
PID 856 wrote to memory of 512	856	Olf0BxIaEk.exe	34
PID 856 wrote to memory of 512	856	Olf0BxIaEk.exe	34
PID 1584 wrote to memory of 1556	1584	taskeng.exe	37
PID 1584 wrote to memory of 1556	1584	taskeng.exe	37
PID 1584 wrote to memory of 1556	1584	taskeng.exe	37
PID 1584 wrote to memory of 1556	1584	taskeng.exe	37
PID 1556 wrote to memory of 292	1556	sqlcmd.exe	38
PID 1556 wrote to memory of 292	1556	sqlcmd.exe	38
PID 1556 wrote to memory of 292	1556	sqlcmd.exe	38
PID 1556 wrote to memory of 292	1556	sqlcmd.exe	38

C:\Users\Admin\AppData\Local\Temp\3e27de3882e7243f71c7ac2df3de2be4.exe
"C:\Users\Admin\AppData\Local\Temp\3e27de3882e7243f71c7ac2df3de2be4.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\Olf0BxIaEk.exe
  "C:\Users\Admin\AppData\Local\Temp\Olf0BxIaEk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\3e27de3882e7243f71c7ac2df3de2be4.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:812

C:\Windows\system32\taskeng.exe
taskeng.exe {2E567530-62B6-427B-A101-9D9C9F0A1360} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:292