37f06f87355592007d3f0a6acc3e0535b0a5d5d2e224280e5a5f8792cf88c9e4

General

Target

b1d856afe8ffd2649843d64affe9d4c3.exe
Size

3.9MB
MD5

b1d856afe8ffd2649843d64affe9d4c3
SHA1

6015d16a00f0c4ad3d68c8c83ae20305a1127a99
SHA256

37f06f87355592007d3f0a6acc3e0535b0a5d5d2e224280e5a5f8792cf88c9e4
SHA512

6c707636d934cfeefc42271d3bc4ca82cb243ed42b5bf2f999f7529cb4a761365bb94382d38ed4c0e9549ff9580d627414d3461ace467a8986faeaaf08707cab

Score

7^/10

evasion spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

b1d856afe8ffd2649843d64affe9d4c3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b1d856afe8ffd2649843d64affe9d4c3.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

b1d856afe8ffd2649843d64affe9d4c3.exe

description	pid	process
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe
Token: SeManageVolumePrivilege	4120	b1d856afe8ffd2649843d64affe9d4c3.exe

C:\Users\Admin\AppData\Local\Temp\b1d856afe8ffd2649843d64affe9d4c3.exe
"C:\Users\Admin\AppData\Local\Temp\b1d856afe8ffd2649843d64affe9d4c3.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:4120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4120-124-0x0000000003FB0000-0x0000000003FC0000-memory.dmp

Filesize
64KB

Download
memory/4120-130-0x0000000004150000-0x0000000004160000-memory.dmp

Filesize
64KB

Download
memory/4120-147-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/4120-151-0x00000000047B0000-0x00000000047B8000-memory.dmp

Filesize
32KB

Download
memory/4120-154-0x0000000004B70000-0x0000000004B78000-memory.dmp

Filesize
32KB

Download
memory/4120-156-0x0000000004740000-0x0000000004748000-memory.dmp

Filesize
32KB

Download
memory/4120-157-0x00000000030A0000-0x00000000030A8000-memory.dmp

Filesize
32KB

Download
memory/4120-158-0x00000000030A0000-0x00000000030A8000-memory.dmp

Filesize
32KB

Download
memory/4120-159-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-160-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-161-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-162-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-163-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-164-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-165-0x0000000004760000-0x0000000004768000-memory.dmp

Filesize
32KB

Download
memory/4120-166-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-167-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-168-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download
memory/4120-169-0x00000000036A0000-0x00000000036A8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing