09bbc753aa0ac277e42418b81587e1362c5dea6798432b3f589f0dae187d7953

General

Target

0a90fcb89e5c36783d14359dfd0d2462.exe
Size

2.9MB
MD5

0a90fcb89e5c36783d14359dfd0d2462
SHA1

2ff0e1a4c591dfc6182c4f58209ae02210abff86
SHA256

09bbc753aa0ac277e42418b81587e1362c5dea6798432b3f589f0dae187d7953
SHA512

bf043ddd6c6c4ac363d4f62399be6eb396f6f8ece8310cd4164eaf7109a62c5e44b7f2a3e1eb75f47f8c11942dc7a47f25680f6ffd4314212f563dcea0f46b81

Score

8^/10

spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1552	da_1648136254601.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014137-59.dat	upx
behavioral1/files/0x0006000000014137-60.dat	upx
behavioral1/files/0x0006000000014137-61.dat	upx
behavioral1/files/0x0006000000014137-62.dat	upx
behavioral1/files/0x0006000000014137-64.dat	upx
behavioral1/files/0x0006000000014137-66.dat	upx

Loads dropped DLL 4 IoCs

pid	Process
1644	0a90fcb89e5c36783d14359dfd0d2462.exe
1644	0a90fcb89e5c36783d14359dfd0d2462.exe
1644	0a90fcb89e5c36783d14359dfd0d2462.exe
1644	0a90fcb89e5c36783d14359dfd0d2462.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1552	1644	0a90fcb89e5c36783d14359dfd0d2462.exe	31
PID 1644 wrote to memory of 1552	1644	0a90fcb89e5c36783d14359dfd0d2462.exe	31
PID 1644 wrote to memory of 1552	1644	0a90fcb89e5c36783d14359dfd0d2462.exe	31
PID 1644 wrote to memory of 1552	1644	0a90fcb89e5c36783d14359dfd0d2462.exe	31

C:\Users\Admin\AppData\Local\Temp\0a90fcb89e5c36783d14359dfd0d2462.exe
"C:\Users\Admin\AppData\Local\Temp\0a90fcb89e5c36783d14359dfd0d2462.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe
  "C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe"
  2⤵
  - Executes dropped EXE
  PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe

Filesize
2.0MB

MD5
369727c8448874edcbf2ad2db5f5271a

SHA1
f962a928e24071d2cf63b3e67abaca1d40b840b7

SHA256
fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739

SHA512
11cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970

Download Submit
C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe

Filesize
2.0MB

MD5
369727c8448874edcbf2ad2db5f5271a

SHA1
f962a928e24071d2cf63b3e67abaca1d40b840b7

SHA256
fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739

SHA512
11cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970

Download Submit
\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe

Filesize
2.0MB

MD5
369727c8448874edcbf2ad2db5f5271a

SHA1
f962a928e24071d2cf63b3e67abaca1d40b840b7

SHA256
fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739

SHA512
11cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970

Download Submit
\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe

Filesize
2.0MB

MD5
369727c8448874edcbf2ad2db5f5271a

SHA1
f962a928e24071d2cf63b3e67abaca1d40b840b7

SHA256
fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739

SHA512
11cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970

Download Submit
\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe

Filesize
2.0MB

MD5
369727c8448874edcbf2ad2db5f5271a

SHA1
f962a928e24071d2cf63b3e67abaca1d40b840b7

SHA256
fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739

SHA512
11cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970

Download Submit
\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe

Filesize
2.0MB

MD5
369727c8448874edcbf2ad2db5f5271a

SHA1
f962a928e24071d2cf63b3e67abaca1d40b840b7

SHA256
fe06db434d5e0cca0d0c72627fc732bfca85d3708649464e5b61d814468ee739

SHA512
11cd32a2284f611da89788622414065804aacdebfaba8c07c48d2ffe18b063df6e8f5945f119a4335ce15daa97a455237c578c02bcf85cf4827542a205cb0970

Download Submit
memory/1644-54-0x0000000002270000-0x0000000002528000-memory.dmp

Filesize
2.7MB

Download
memory/1644-55-0x00000000759B1000-0x00000000759B3000-memory.dmp

Filesize
8KB

Download
memory/1644-56-0x0000000002270000-0x0000000002528000-memory.dmp

Filesize
2.7MB

Download
memory/1644-57-0x0000000002530000-0x0000000002A28000-memory.dmp

Filesize
5.0MB

Download
memory/1644-58-0x0000000000400000-0x0000000000906000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing