9ff286f4a4938d6f49156f8dd7303c12ad904c3e73cd1f223a56260e7604658b

Analysis

Target

Otsylka za proshlyj i za etot mesyac.exe
Size

180KB
MD5

4d4a51025d7ac625fbc4243d8043b0e2
SHA1

12c789d04f3feb0e62bdb09ead849a54e2175882
SHA256

d768486542d55538cb90b21c8563f395ed3d5148733e23a67bc5dba74b811233
SHA512

ceb123c160e5f058eb13917f83612eb014e84d0e6a23b19f5c08f254d03e939302ca25c46dde4b816e5e6807ebe0ef3843a6059d2dc45e92c5f7d6c709a756a0

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1940 PING.EXE
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 5 WinHttp.WinHttpRequest.5.1
HTTP User-Agent header 7 WinHttp.WinHttpRequest.5.1

pid	process
1940	PING.EXE

description	flow	ioc
HTTP User-Agent header	5	WinHttp.WinHttpRequest.5.1
HTTP User-Agent header	7	WinHttp.WinHttpRequest.5.1

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Otsylka za proshlyj i za etot mesyac.exeOtsylka za proshlyj i za etot mesyac.execmd.exe

description	pid	process	target process
PID 2128 wrote to memory of 4716	2128	Otsylka za proshlyj i za etot mesyac.exe	Otsylka za proshlyj i za etot mesyac.exe
PID 2128 wrote to memory of 4716	2128	Otsylka za proshlyj i za etot mesyac.exe	Otsylka za proshlyj i za etot mesyac.exe
PID 2128 wrote to memory of 4716	2128	Otsylka za proshlyj i za etot mesyac.exe	Otsylka za proshlyj i za etot mesyac.exe
PID 4716 wrote to memory of 1420	4716	Otsylka za proshlyj i za etot mesyac.exe	cmd.exe
PID 4716 wrote to memory of 1420	4716	Otsylka za proshlyj i za etot mesyac.exe	cmd.exe
PID 1420 wrote to memory of 1940	1420	cmd.exe	PING.EXE
PID 1420 wrote to memory of 1940	1420	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\Otsylka za proshlyj i za etot mesyac.exe
"C:\Users\Admin\AppData\Local\Temp\Otsylka za proshlyj i za etot mesyac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128

C:\Users\Admin\AppData\Local\Temp\Otsylka za proshlyj i za etot mesyac.exe
"C:\Users\Admin\AppData\Local\Temp\Otsylka za proshlyj i za etot mesyac.exe" dfsr
2⤵
- Suspicious use of WriteProcessMemory
PID:4716

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\Otsylka za proshlyj i za etot mesyac.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1420

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Remote System Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/1420-134-0x0000000000000000-mapping.dmp

Download
memory/1940-135-0x0000000000000000-mapping.dmp

Download
memory/2128-131-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/2128-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4716-130-0x0000000000000000-mapping.dmp

Download
memory/4716-133-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download