b931c903ff14d82dce6daf9934209b5c71f982359847ed3e342e25fa88c99f03

Analysis

max time kernel
36s
max time network
19s
platform
windows7_x64
resource
win7-en-20211208
submitted
01/01/2022, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OkEgjVmQ0rPYTjBDwBy70NyH.exe
Size 1.8MB
Sample220101-ryw8dsgbhj
SHA256 d654c6c1643997b6c6d8e8133e867e52c3176f3e6ed3827ea5f4e29023817115
MD5 53074ccaf36bc24fd4286062f0cdac98
SHA1 2ca97c4d5dfacfc29d8feee90cd7de2eff651225
SHA512 4a47f2fad7dcf2fefb8fd4ed2714b90f13b4cfec755521db27fb131fce068168f31e1edb0d2dc7f5eb867f992063a37ce5022e7a8a894f906fc91ed1c1be6ef5
MD5 SHA1 SHA512

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1792	se.exe
1816	poqa.exe

Loads dropped DLL 8 IoCs

pid	Process
748	OkEgjVmQ0rPYTjBDwBy70NyH.exe
748	OkEgjVmQ0rPYTjBDwBy70NyH.exe
1792	se.exe
1792	se.exe
1792	se.exe
1792	se.exe
1792	se.exe
740	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1792	se.exe
1792	se.exe
1792	se.exe
1792	se.exe
1816	poqa.exe
1792	se.exe
1816	poqa.exe
1792	se.exe
1816	poqa.exe
1792	se.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1792	748	OkEgjVmQ0rPYTjBDwBy70NyH.exe	27
PID 748 wrote to memory of 1792	748	OkEgjVmQ0rPYTjBDwBy70NyH.exe	27
PID 748 wrote to memory of 1792	748	OkEgjVmQ0rPYTjBDwBy70NyH.exe	27
PID 748 wrote to memory of 1792	748	OkEgjVmQ0rPYTjBDwBy70NyH.exe	27
PID 1792 wrote to memory of 1816	1792	se.exe	28
PID 1792 wrote to memory of 1816	1792	se.exe	28
PID 1792 wrote to memory of 1816	1792	se.exe	28

C:\Users\Admin\AppData\Local\Temp\OkEgjVmQ0rPYTjBDwBy70NyH.exe
"C:\Users\Admin\AppData\Local\Temp\OkEgjVmQ0rPYTjBDwBy70NyH.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\se.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\se.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\poqa.exe
    poqa.exe -f json
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Download

memory/1792-70-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/1792-67-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/1792-68-0x0000000140000000-0x0000000140215000-memory.dmp

Download

memory/1816-77-0x0000000000400000-0x000000000141C000-memory.dmp

Download

memory/1816-78-0x0000000000400000-0x000000000141C000-memory.dmp

Download

memory/1816-80-0x0000000000400000-0x000000000141C000-memory.dmp

Download

memory/1816-81-0x0000000000400000-0x000000000141C000-memory.dmp

Download

memory/1816-82-0x0000000000400000-0x000000000141C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads