98a293de8d3eb34cee5e3e8edc9f472323d13a997bdbd2806ac1fe483f5efd14

General

Target
59e040f29d21977054f5bd3510c4250c.exe
Size 296KB
Sample211218-k2rnraefg7
SHA256 98a293de8d3eb34cee5e3e8edc9f472323d13a997bdbd2806ac1fe483f5efd14
MD5 59e040f29d21977054f5bd3510c4250c
SHA1 817cd6391c3dd8eaa33969121eb186c29cda4d2a
SHA512 4d109a922a08bbeb61a9d992b1eb696f7ab789deb50f878672bfd3d312b2d7bffa88bb9c7328730f5317e2a9de2cde771c39adbc41cf2bfa1040b89af4157dce
MD5 SHA1 SHA512

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe
File created	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe
File created	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe
File created	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe
File opened for modification	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe
File created	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe
File created	C:\Users\Admin\AppData\Local\4a2a0ffffaf0a657b3dabd63cf0347f3\Admin@MHKKHUYI_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	59e040f29d21977054f5bd3510c4250c.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com
32	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	59e040f29d21977054f5bd3510c4250c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	59e040f29d21977054f5bd3510c4250c.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3808	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2900	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe
3592	59e040f29d21977054f5bd3510c4250c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	59e040f29d21977054f5bd3510c4250c.exe
Token: SeDebugPrivilege	2900	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4520	3592	59e040f29d21977054f5bd3510c4250c.exe	70
PID 3592 wrote to memory of 4520	3592	59e040f29d21977054f5bd3510c4250c.exe	70
PID 4520 wrote to memory of 3728	4520	cmd.exe	72
PID 4520 wrote to memory of 3728	4520	cmd.exe	72
PID 4520 wrote to memory of 2600	4520	cmd.exe	73
PID 4520 wrote to memory of 2600	4520	cmd.exe	73
PID 4520 wrote to memory of 3220	4520	cmd.exe	74
PID 4520 wrote to memory of 3220	4520	cmd.exe	74
PID 3592 wrote to memory of 796	3592	59e040f29d21977054f5bd3510c4250c.exe	75
PID 3592 wrote to memory of 796	3592	59e040f29d21977054f5bd3510c4250c.exe	75
PID 796 wrote to memory of 396	796	cmd.exe	77
PID 796 wrote to memory of 396	796	cmd.exe	77
PID 796 wrote to memory of 1032	796	cmd.exe	78
PID 796 wrote to memory of 1032	796	cmd.exe	78
PID 3592 wrote to memory of 2508	3592	59e040f29d21977054f5bd3510c4250c.exe	79
PID 3592 wrote to memory of 2508	3592	59e040f29d21977054f5bd3510c4250c.exe	79
PID 2508 wrote to memory of 2696	2508	cmd.exe	81
PID 2508 wrote to memory of 2696	2508	cmd.exe	81
PID 2508 wrote to memory of 2900	2508	cmd.exe	82
PID 2508 wrote to memory of 2900	2508	cmd.exe	82
PID 2508 wrote to memory of 3808	2508	cmd.exe	83
PID 2508 wrote to memory of 3808	2508	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\59e040f29d21977054f5bd3510c4250c.exe
"C:\Users\Admin\AppData\Local\Temp\59e040f29d21977054f5bd3510c4250c.exe"
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3728
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:2600
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:3220
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:396
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:1032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpFD26.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpFD26.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2696
- - C:\Windows\system32\taskkill.exe
    TaskKill /F /IM 3592
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\system32\timeout.exe
    Timeout /T 2 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3592-131-0x000002005F700000-0x000002005F701000-memory.dmp

Download

memory/3592-127-0x000002005D842000-0x000002005D844000-memory.dmp

Download

memory/3592-128-0x000002005D844000-0x000002005D846000-memory.dmp

Download

memory/3592-129-0x000002005EC50000-0x000002005EC51000-memory.dmp

Download

memory/3592-130-0x000002005F000000-0x000002005F001000-memory.dmp

Download

memory/3592-115-0x00000200432F0000-0x00000200432F1000-memory.dmp

Download

memory/3592-119-0x000002005D840000-0x000002005D842000-memory.dmp

Download

memory/3592-118-0x0000020044DD0000-0x0000020044DD1000-memory.dmp

Download

memory/3592-117-0x0000020044DF0000-0x0000020044E5F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads