1f42fcd0060ea1cd970a998dd6d8588e38975045a0b4ffe8bad383711498fbc6

Analysis

max time kernel
63s
max time network
53s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FichaReembolso.cmd
Size 1.3MB
Sample220908-fwmemaahaj
SHA256 1f42fcd0060ea1cd970a998dd6d8588e38975045a0b4ffe8bad383711498fbc6
MD5 79e6d5064d068858a1a0a588f4bc1f76
SHA1 1b2ed5b0f4b63e24ce9fdfb3d56645e9cd9eab5a
SHA512 33b7d4e893bc0b0cd9935f8b0aebd9acb9b43adb7c1a8ebb48119857fcd6296b6062a2e5d9e5f10275d2bfaa86973f1ccfa3d0953892b383c8c1f68f82bc1fa0
SSDEEP 24576:I31wpEXwODAVkSnz3R/sOfRQEZZjEg6GEaeJu47fnpdRgaCQIAYhrz:TpzqABDBsA5Z4lLD0H9z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
832	RINDI%xxxxx%.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1608	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	RINDI%xxxxx%.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe
832	RINDI%xxxxx%.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 896	1356	cmd.exe	29
PID 1356 wrote to memory of 896	1356	cmd.exe	29
PID 1356 wrote to memory of 896	1356	cmd.exe	29
PID 896 wrote to memory of 1340	896	cmd.exe	31
PID 896 wrote to memory of 1340	896	cmd.exe	31
PID 896 wrote to memory of 1340	896	cmd.exe	31
PID 896 wrote to memory of 1196	896	cmd.exe	32
PID 896 wrote to memory of 1196	896	cmd.exe	32
PID 896 wrote to memory of 1196	896	cmd.exe	32
PID 896 wrote to memory of 1748	896	cmd.exe	34
PID 896 wrote to memory of 1748	896	cmd.exe	34
PID 896 wrote to memory of 1748	896	cmd.exe	34
PID 896 wrote to memory of 1200	896	cmd.exe	33
PID 896 wrote to memory of 1200	896	cmd.exe	33
PID 896 wrote to memory of 1200	896	cmd.exe	33
PID 896 wrote to memory of 1608	896	cmd.exe	37
PID 896 wrote to memory of 1608	896	cmd.exe	37
PID 896 wrote to memory of 1608	896	cmd.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Windows\system32\more.com
    more +5 C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd
    3⤵
    PID:1340
- - C:\Windows\system32\certutil.exe
    certutil -decode -f ~~ "C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe"
    3⤵
    PID:1196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process call create '"C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe" "C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x" ""' ,C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\system32\certutil.exe
    certutil -decode -f C:\Users\Admin\AppData\Local\Temp\FichaReembolso.cmd "C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x"
    3⤵
    PID:1748
- - C:\Windows\system32\timeout.exe
    timeout /T 5
    3⤵
    - Delays execution with timeout.exe
    PID:1608

C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe
"C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe" "C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x" ""
1⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\Temp\~~
Size 1.3MB
SHA256 3a207a34910c4318a526fe189a14e3c10fe964e66859242e971d2372afbc1364
MD5 66fee3830e23da28954e4491b0c3f9b2
SHA1 8a6fca0e55e109c9a649622b1d7a034abf4c18b7
SHA512 a5c372cc2b5c18a612224739de988f987df2caa42e87bcb2f628a2a6b91c49fab0360686cf5cac3d05a736e5c6899e60029ea7decf6addbfaafc671bcbb9c8c9
SSDEEP 24576:OotxQMlJvzjVvWPsIFTwNat85B+OzGbfs6odtyq1WEReBCng0UxYf:zQCbjoZT85wKcNIhiOf
MD5 SHA1 SHA512 SSDEEP

Submit Download

FichaReembolso.a3x

Path C:\Users\Admin\AppData\Roaming\jkjlhkj\a3x\X2NI\FichaReembolso.a3x
Size 111KB
SHA256 7382071007ef458d22b2fc27500369a3fa1785dbac209c121c2e522797ab7bd0
MD5 78c5433f96819d8b95dddf6ecb40b21c
SHA1 e9ae15dcc696f252851d82c7338364bd4c4bbe5e
SHA512 9505ef1965f1c4c6981a28630fa028d15c4df18f5bca74457b39408ee816ed542bc7a9e7ef3f9aa8dbb1fa2c4c53748777df42df22f6b73873a01e4b9827067f
SSDEEP 3072:J23w3LuvYgsX0/ybKMl3uMhyHTRb7+jvcrl8iIo:Q3w7uwg61uI3unzRb7acrl83o
MD5 SHA1 SHA512 SSDEEP

Submit Download

RINDI%~1.EXE

Path C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\V3314~1.5_2\RINDI%~1.EXE
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

RINDI%xxxxx%.exe

Path C:\Users\Admin\AppData\Roaming\jkjlhkj\exe\v3.3.14.5_20180315\RINDI%xxxxx%.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/832-64-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Download

memory/1196-57-0x00000000FFCB1000-0x00000000FFCB3000-memory.dmp

Download

memory/1748-60-0x00000000FF771000-0x00000000FF773000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads