3093fc14a0bb06b811cfd1551715b43f74fdbe75b179e27e44f737a2a1c7154c

Analysis

max time kernel
113s
max time network
124s
platform
windows10_x64
resource
win10-en-20211014
submitted
18/11/2021, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JGKWRU.exe
Size 1.5MB
Sample211118-d23bxsefb4
SHA256 3093fc14a0bb06b811cfd1551715b43f74fdbe75b179e27e44f737a2a1c7154c
MD5 065f2d7e157ab8e18acb4981e0ffee15
SHA1 fead21dd89c64c80a4619fa1af208afc0a768692
SHA512 cc7bc32455775cc594467a14f0bc93813ee8f1dc06c1d19d9e552586127015218e80e709276ac3ed960a2413965f20f16d4b0c81807f7f6f403b1e0745a8e6df
MD5 SHA1 SHA512

Score

8^/10

collection spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2268	A.exe
3852	B.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000000687-117.dat	upx
behavioral2/files/0x0007000000000687-118.dat	upx
behavioral2/files/0x000800000001ab8c-122.dat	upx
behavioral2/files/0x000800000001ab8c-123.dat	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2268	A.exe
2268	A.exe
2268	A.exe
2268	A.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3740	2500	JGKWRU.exe	68
PID 2500 wrote to memory of 3740	2500	JGKWRU.exe	68
PID 2500 wrote to memory of 3740	2500	JGKWRU.exe	68
PID 3740 wrote to memory of 2268	3740	cmd.exe	70
PID 3740 wrote to memory of 2268	3740	cmd.exe	70
PID 3740 wrote to memory of 2268	3740	cmd.exe	70
PID 2500 wrote to memory of 588	2500	JGKWRU.exe	71
PID 2500 wrote to memory of 588	2500	JGKWRU.exe	71
PID 2500 wrote to memory of 588	2500	JGKWRU.exe	71
PID 588 wrote to memory of 3852	588	cmd.exe	73
PID 588 wrote to memory of 3852	588	cmd.exe	73
PID 588 wrote to memory of 3852	588	cmd.exe	73

C:\Users\Admin\AppData\Local\Temp\JGKWRU.exe
"C:\Users\Admin\AppData\Local\Temp\JGKWRU.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c A.exe /stext A.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Users\Admin\AppData\Local\Temp\A.exe
    A.exe /stext A.txt
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c B.exe /stext B.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Users\Admin\AppData\Local\Temp\B.exe
    B.exe /stext B.txt
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads