8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93

General

Target

8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe
Size

819KB
MD5

ee810aa35b1ce682aa6444e8d86a7c2e
SHA1

15d8bc116b16258fb988b0651e3050680ff4cfce
SHA256

8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93
SHA512

2bc66700933ee5d0e3673414416cd038e2e9bb20cbc48bdc3e5cb3cc75f5e65cc7194844bffb4b88a875d1166e22b109e220061e61fae9f96f76c7f623ec54d1
SSDEEP

24576:Txw+ZGzBmq1+bIAt/9oq8RGTgnwTRA1gQp5q1:7ZAvyFx9scUwTRCgQp01

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	UFR_Stealer - êîïèÿ.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000139f7-56.dat	upx
behavioral1/files/0x000a0000000139f7-57.dat	upx
behavioral1/files/0x000a0000000139f7-59.dat	upx
behavioral1/memory/1968-63-0x0000000000400000-0x000000000057C000-memory.dmp	upx
behavioral1/memory/1968-64-0x0000000000400000-0x000000000057C000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1776	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe
1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe
1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1968	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	28
PID 1844 wrote to memory of 1968	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	28
PID 1844 wrote to memory of 1968	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	28
PID 1844 wrote to memory of 1968	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	28
PID 1844 wrote to memory of 1776	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	29
PID 1844 wrote to memory of 1776	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	29
PID 1844 wrote to memory of 1776	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	29
PID 1844 wrote to memory of 1776	1844	8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe	29

C:\Users\Admin\AppData\Local\Temp\8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe
"C:\Users\Admin\AppData\Local\Temp\8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\UFR_Stealer - êîïèÿ.exe
  "C:\Users\Admin\AppData\Local\Temp\UFR_Stealer - êîïèÿ.exe"
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\8c249bef51e81c63f66a2ee4c3b5d4c85b44016633a88b6fd9d8c9f2188cad93.exe" >> NUL
  2⤵
  - Deletes itself
  PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UFR_Stealer - êîïèÿ.exe

Filesize
753KB

MD5
30719fe6f02d4625ba28570c7a6e8b2c

SHA1
a5ba3297c851f7c85e7d940b50fedce125903aea

SHA256
0d79bbc00ce0bc6831d7fb0a69eb40594298b6d47a291dab5373fccc2a9f516c

SHA512
2b40f62c2db4a7c9afd260c8095e30b8574edcc3e088b215e1fc4a30ddcfda98169d78ddbc88ddc087f787f252fcc279e01b3aab27a95985fa3f6030095171c5

Download Submit
\Users\Admin\AppData\Local\Temp\UFR_Stealer - êîïèÿ.exe

Filesize
753KB

MD5
30719fe6f02d4625ba28570c7a6e8b2c

SHA1
a5ba3297c851f7c85e7d940b50fedce125903aea

SHA256
0d79bbc00ce0bc6831d7fb0a69eb40594298b6d47a291dab5373fccc2a9f516c

SHA512
2b40f62c2db4a7c9afd260c8095e30b8574edcc3e088b215e1fc4a30ddcfda98169d78ddbc88ddc087f787f252fcc279e01b3aab27a95985fa3f6030095171c5

Download Submit
\Users\Admin\AppData\Local\Temp\UFR_Stealer - êîïèÿ.exe

Filesize
753KB

MD5
30719fe6f02d4625ba28570c7a6e8b2c

SHA1
a5ba3297c851f7c85e7d940b50fedce125903aea

SHA256
0d79bbc00ce0bc6831d7fb0a69eb40594298b6d47a291dab5373fccc2a9f516c

SHA512
2b40f62c2db4a7c9afd260c8095e30b8574edcc3e088b215e1fc4a30ddcfda98169d78ddbc88ddc087f787f252fcc279e01b3aab27a95985fa3f6030095171c5

Download Submit
memory/1844-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1844-55-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1844-62-0x0000000000400000-0x0000000000508000-memory.dmp

Filesize
1.0MB

Download
memory/1968-63-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1968-64-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing