2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2

Target

Fri051e1e7444.exe
Size

403KB
MD5

b4c503088928eef0e973a269f66a0dd2
SHA1

eb7f418b03aa9f21275de0393fcbf0d03b9719d5
SHA256

2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
SHA512

c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465

Score

10^/10

evasion spyware stealer suricata trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
588	kQYSgQbaI1fTU2hDNoPyd5F8.exe
1480	TOOohBs_93T5x4WAmod17EPW.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Fri051e1e7444.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ipinfo.io
22	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2728	Fri051e1e7444.exe
2728	Fri051e1e7444.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe
1268	PBKC4FSzUmP9Amt9zM0e30i8.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 1268	2728	Fri051e1e7444.exe	69
PID 2728 wrote to memory of 1268	2728	Fri051e1e7444.exe	69
PID 2728 wrote to memory of 588	2728	Fri051e1e7444.exe	70
PID 2728 wrote to memory of 588	2728	Fri051e1e7444.exe	70
PID 2728 wrote to memory of 588	2728	Fri051e1e7444.exe	70
PID 2728 wrote to memory of 1480	2728	Fri051e1e7444.exe	71
PID 2728 wrote to memory of 1480	2728	Fri051e1e7444.exe	71

C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe
"C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\Pictures\Adobe Films\PBKC4FSzUmP9Amt9zM0e30i8.exe
  "C:\Users\Admin\Pictures\Adobe Films\PBKC4FSzUmP9Amt9zM0e30i8.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Users\Admin\Pictures\Adobe Films\kQYSgQbaI1fTU2hDNoPyd5F8.exe
  "C:\Users\Admin\Pictures\Adobe Films\kQYSgQbaI1fTU2hDNoPyd5F8.exe"
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Users\Admin\Pictures\Adobe Films\TOOohBs_93T5x4WAmod17EPW.exe
  "C:\Users\Admin\Pictures\Adobe Films\TOOohBs_93T5x4WAmod17EPW.exe"
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Users\Admin\Pictures\Adobe Films\Us8e0srz63aTs_Cvlt4RfbAD.exe
  "C:\Users\Admin\Pictures\Adobe Films\Us8e0srz63aTs_Cvlt4RfbAD.exe"
  2⤵
  PID:1072
- C:\Users\Admin\Pictures\Adobe Films\Hr1rsTF2JgD8IUzT_IBMiwfa.exe
  "C:\Users\Admin\Pictures\Adobe Films\Hr1rsTF2JgD8IUzT_IBMiwfa.exe"
  2⤵
  PID:1616