f924ce3f6a807491787d5ea90e0e06d93a5bed9c1a2e853f97afb8bb667233a8

Analysis

max time kernel
272s
max time network
295s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/09/2022, 04:59

Target

F924CE3F6A807491787D5EA90E0E06D93A5BED9C1A2E853F97AFB8BB667233A8.exe
Size

5.1MB
MD5

918f2668a711891513d2b6bc3f1a7c12
SHA1

272c0b666215e74a52084e54c019364b1d9ca4b8
SHA256

f924ce3f6a807491787d5ea90e0e06d93a5bed9c1a2e853f97afb8bb667233a8
SHA512

1387e65962714e4f320f05595050cd48874fd587e8ed6ad5942ef2d505c547cf97cd42ba0ac60d0b56573f392ddc039130bc55a6aef27ee6399bdf7ef621b407
SSDEEP

98304:oVrkN3B3Rq1BOBhPWdiN/Px8218eo5nsgYCfoD+bgMd4NlQAc685C:o5u3riBKjx8G8eynyCgDqgMd4Q9PC

Score

8^/10

spyware stealer upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/304-54-0x00000000001A0000-0x000000000145E000-memory.dmp	upx
behavioral1/memory/304-55-0x00000000001A0000-0x000000000145E000-memory.dmp	upx
behavioral1/memory/304-65-0x00000000001A0000-0x000000000145E000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1668	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 1668	304	F924CE3F6A807491787D5EA90E0E06D93A5BED9C1A2E853F97AFB8BB667233A8.exe	27
PID 304 wrote to memory of 1668	304	F924CE3F6A807491787D5EA90E0E06D93A5BED9C1A2E853F97AFB8BB667233A8.exe	27
PID 304 wrote to memory of 1668	304	F924CE3F6A807491787D5EA90E0E06D93A5BED9C1A2E853F97AFB8BB667233A8.exe	27

C:\Users\Admin\AppData\Local\Temp\F924CE3F6A807491787D5EA90E0E06D93A5BED9C1A2E853F97AFB8BB667233A8.exe
"C:\Users\Admin\AppData\Local\Temp\F924CE3F6A807491787D5EA90E0E06D93A5BED9C1A2E853F97AFB8BB667233A8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "" "Get-WmiObject Win32_PortConnector"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/304-54-0x00000000001A0000-0x000000000145E000-memory.dmp

Filesize
18.7MB

Download
memory/304-55-0x00000000001A0000-0x000000000145E000-memory.dmp

Filesize
18.7MB

Download
memory/304-65-0x00000000001A0000-0x000000000145E000-memory.dmp

Filesize
18.7MB

Download
memory/1668-57-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/1668-58-0x000007FEF3990000-0x000007FEF43B3000-memory.dmp

Filesize
10.1MB

Download
memory/1668-60-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/1668-59-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

Filesize
11.4MB

Download
memory/1668-61-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/1668-62-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download
memory/1668-63-0x0000000002864000-0x0000000002867000-memory.dmp

Filesize
12KB

Download
memory/1668-64-0x000000000286B000-0x000000000288A000-memory.dmp

Filesize
124KB

Download