e024cdc86e86ed70ee832fa2b123cf89c6c78bac46337e2738b12b2b03399661

General

Target
3e27de3882e7243f71c7ac2df3de2be4.exe
Size 493KB
Sample210724-aa7pnswt9e
SHA256 e024cdc86e86ed70ee832fa2b123cf89c6c78bac46337e2738b12b2b03399661
MD5 3e27de3882e7243f71c7ac2df3de2be4
SHA1 733b956aa60d07e60809764037bcca854b01e73f
SHA512 c1e6259e6fa92bfb98e0ef9566083d39a9e2451586e375599163b8e09e5189c197dbaedfc5092b7f0ec2a7b116667a4bd9e4deb72f99d6d550c9787f8a5e142d
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
1300	UkJPQZNiq5.exe
1056	sqlcmd.exe

Loads dropped DLL 5 IoCs

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3796	schtasks.exe
2304	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1004	timeout.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1300	992	3e27de3882e7243f71c7ac2df3de2be4.exe	78
PID 992 wrote to memory of 1300	992	3e27de3882e7243f71c7ac2df3de2be4.exe	78
PID 992 wrote to memory of 1300	992	3e27de3882e7243f71c7ac2df3de2be4.exe	78
PID 992 wrote to memory of 1852	992	3e27de3882e7243f71c7ac2df3de2be4.exe	79
PID 992 wrote to memory of 1852	992	3e27de3882e7243f71c7ac2df3de2be4.exe	79
PID 992 wrote to memory of 1852	992	3e27de3882e7243f71c7ac2df3de2be4.exe	79
PID 1852 wrote to memory of 1004	1852	cmd.exe	81
PID 1852 wrote to memory of 1004	1852	cmd.exe	81
PID 1852 wrote to memory of 1004	1852	cmd.exe	81
PID 1300 wrote to memory of 3796	1300	UkJPQZNiq5.exe	82
PID 1300 wrote to memory of 3796	1300	UkJPQZNiq5.exe	82
PID 1300 wrote to memory of 3796	1300	UkJPQZNiq5.exe	82
PID 1056 wrote to memory of 2304	1056	sqlcmd.exe	85
PID 1056 wrote to memory of 2304	1056	sqlcmd.exe	85
PID 1056 wrote to memory of 2304	1056	sqlcmd.exe	85

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
  2⤵
  - Creates scheduled task(s)
  PID:2304