e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28

General

Target

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
Size

361KB
MD5

e2eb762d6d248fec5b8af8ab437cfdc2
SHA1

c6be1c85d65136e6ce2cc098db499837d2c5ea9e
SHA256

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28
SHA512

0c85ede00a5ae7d0fe5aabfb9b662c6329922e6278bc80b59384234891a1383fe53d7931b9ca7d52ac95a355cd10840a4886a268238e347077d91fb0ba7d3a33

Score

9^/10

evasion spyware stealer

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

UnprotectRequest.exe

pid process

1892 UnprotectRequest.exe
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

pid	process
1892	UnprotectRequest.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\WINE	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\WINE	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

pid	process
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

description pid process

Token: SeSecurityPrivilege 4124 e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

description	pid	process
Token: SeSecurityPrivilege	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exeUnprotectRequest.exe

description	pid	process	target process
PID 4124 wrote to memory of 1892	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe	UnprotectRequest.exe
PID 4124 wrote to memory of 1892	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe	UnprotectRequest.exe
PID 4124 wrote to memory of 1892	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe	UnprotectRequest.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 984	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 1892 wrote to memory of 2316	1892	UnprotectRequest.exe	svchost.exe
PID 4124 wrote to memory of 2576	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe	cmd.exe
PID 4124 wrote to memory of 2576	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe	cmd.exe
PID 4124 wrote to memory of 2576	4124	e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe
"C:\Users\Admin\AppData\Local\Temp\e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\UnprotectRequest.exe
"C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\UnprotectRequest.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
3⤵
PID:984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
3⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upda7fa0452.bat"
2⤵
PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

4

T1497

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

5

T1012

Virtualization/Sandbox Evasion

4

T1497

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\upda7fa0452.bat
Filesize
313B

MD5
b80a6eb7e04a056bdc95ec58fb57a8e1

SHA1
3cd4edce447ffa5c13c1cd1620f5aa8a00aa4b20

SHA256
a04be7479c907a9892d8092febd4c7fdd77569eab7e3e63aec75b533239212f7

SHA512
94a56edc71c0d4ddacb17e9573a03f1ea89cc954f62468ae1aeda8d4a3ccdbaef21abf1d27004582a4219ce0ca35ebc90de0c7378d55c2a2632f268833d548f7

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\UnprotectRequest.exe
Filesize
361KB

MD5
e2eb762d6d248fec5b8af8ab437cfdc2

SHA1
c6be1c85d65136e6ce2cc098db499837d2c5ea9e

SHA256
e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28

SHA512
0c85ede00a5ae7d0fe5aabfb9b662c6329922e6278bc80b59384234891a1383fe53d7931b9ca7d52ac95a355cd10840a4886a268238e347077d91fb0ba7d3a33

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\UnprotectRequest.exe
Filesize
361KB

MD5
e2eb762d6d248fec5b8af8ab437cfdc2

SHA1
c6be1c85d65136e6ce2cc098db499837d2c5ea9e

SHA256
e6967a3e28cc938341c5ca21332c84ec700e33ae632cd0c08dc6bbf16b212f28

SHA512
0c85ede00a5ae7d0fe5aabfb9b662c6329922e6278bc80b59384234891a1383fe53d7931b9ca7d52ac95a355cd10840a4886a268238e347077d91fb0ba7d3a33

Download Submit
memory/984-137-0x0000000000000000-mapping.dmp

Download
memory/984-138-0x0000000000790000-0x00000000007B4000-memory.dmp

Filesize
144KB

Download
memory/1892-136-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1892-135-0x0000000002710000-0x000000000273A000-memory.dmp

Filesize
168KB

Download
memory/1892-132-0x0000000000000000-mapping.dmp

Download
memory/2316-139-0x0000000000000000-mapping.dmp

Download
memory/2316-140-0x0000000000880000-0x00000000008A4000-memory.dmp

Filesize
144KB

Download
memory/2576-141-0x0000000000000000-mapping.dmp

Download
memory/4124-130-0x00000000027C0000-0x00000000027EA000-memory.dmp

Filesize
168KB

Download
memory/4124-131-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads