Analysis
-
max time kernel
134s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe
Resource
win7-20220812-en
General
-
Target
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe
-
Size
999KB
-
MD5
5648f68e4a0011dafe8d998faa6ceae9
-
SHA1
a8faf3b312ce52629042f1270f2fa8c2344b04b1
-
SHA256
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa
-
SHA512
e6b47b83e2352bca850f807a23b8fdeae49702f5d6c76a8fcb22165ca1334cf25bd2f8200e1eaa1b8c0193b8f852a74632205c93381f90ed7962df288985fda7
-
SSDEEP
24576:fCUEkTgHq2qJ1W489MripDn7qvdJsj3z9AGOXoYZ7Yeefds:fCVkTB2wW489Mrkn7qvoeGO4Yaeea
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe" 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe -
Modifies firewall policy service 2 TTPs 2 IoCs
Processes:
STEALER.EXEdescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List STEALER.EXE Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\STEALER.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\STEALER.exe:*:Enabled:STEALER" STEALER.EXE -
Processes:
STEALER.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" STEALER.EXE -
Processes:
STEALER.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" STEALER.EXE -
Executes dropped EXE 2 IoCs
Processes:
STEALER.EXESTEALER.EXEpid process 1152 STEALER.EXE 1960 STEALER.EXE -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe -
Loads dropped DLL 3 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exeSTEALER.EXEpid process 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 1152 STEALER.EXE -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
STEALER.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" STEALER.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jusched = "C:\\Users\\Admin\\AppData\\Roaming\\jusched\\jusched.exe" 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe -
Processes:
STEALER.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" STEALER.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exeSTEALER.EXE8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exedescription pid process target process PID 2040 set thread context of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 1152 set thread context of 1960 1152 STEALER.EXE STEALER.EXE PID 1340 set thread context of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000007afc93f767abbb90e1bf523c221d48b49677b85c08e296cdf1be3ee79c03e2d2000000000e800000000200002000000007db5ccf7e186a0e708da6d6c26dd31d715e5d06b9ed257c1ac36e39015509a5900000004c09892ef720eef4fdc88cd01bc486434bc941ddb865e8a6bc834cb22cdd9c4f3a7c9a0e7b088f88d031134714457c2e2f98fcb493db25e0f7f413f5228f4b24a09859209037a5aed98f2fcb2d7ac0a537cc1c9e2d17df04f681e87e5adf0775d9676c37a6bba885d3fc5cd25ba4eea292190521805137b4622832d3bdb7670115a40920204ceda6883d2cf34a7dc1b3400000009ecb4dc74d15c63d4f6fe6d634de928257633d9fe83e684a88188273f6726fcab7bc9d40f3c3d988ab6640f983254bb02924a42a4f249724ca074aa82dda6638 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bb9edc8ed6d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0220D040-4282-11ED-9F7B-6E705F4A26E5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371501152" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000bf87ed409cc46a61fc11b61246d737a7f520a7e09d2bf738ec748023e4a69532000000000e80000000020000200000009ad11b87d15b41c4e93bdee3016dca3873ebeec8ca8236573ca8ea095af9430420000000a80265a9a5ec17d82143acff363420fb7f70ddee30415eb837a8de9bdf9297b04000000077a04614e9d8f0c3dcbad777020af536bab73aa8b39cc1367bccb99f24b7e9e43d0e38465ad527cd48544fea371cde3d7647ba270f083b871283998f06625755 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exeSTEALER.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeSecurityPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeTakeOwnershipPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeLoadDriverPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeSystemProfilePrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeSystemtimePrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeProfSingleProcessPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeIncBasePriorityPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeCreatePagefilePrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeBackupPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeRestorePrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeShutdownPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeDebugPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeSystemEnvironmentPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeChangeNotifyPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeRemoteShutdownPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeUndockPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeManageVolumePrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeImpersonatePrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeCreateGlobalPrivilege 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: 33 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: 34 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: 35 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe Token: SeBackupPrivilege 1960 STEALER.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 684 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
STEALER.EXEiexplore.exeIEXPLORE.EXEpid process 1960 STEALER.EXE 684 iexplore.exe 684 iexplore.exe 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE 1856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exeSTEALER.EXEexplorer.exeiexplore.exedescription pid process target process PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 2040 wrote to memory of 1340 2040 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe PID 1340 wrote to memory of 1152 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe STEALER.EXE PID 1340 wrote to memory of 1152 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe STEALER.EXE PID 1340 wrote to memory of 1152 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe STEALER.EXE PID 1340 wrote to memory of 1152 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1152 wrote to memory of 1960 1152 STEALER.EXE STEALER.EXE PID 1340 wrote to memory of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe PID 1340 wrote to memory of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe PID 1340 wrote to memory of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe PID 1340 wrote to memory of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe PID 1340 wrote to memory of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe PID 1340 wrote to memory of 1104 1340 8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe explorer.exe PID 1104 wrote to memory of 684 1104 explorer.exe iexplore.exe PID 1104 wrote to memory of 684 1104 explorer.exe iexplore.exe PID 1104 wrote to memory of 684 1104 explorer.exe iexplore.exe PID 1104 wrote to memory of 684 1104 explorer.exe iexplore.exe PID 684 wrote to memory of 1856 684 iexplore.exe IEXPLORE.EXE PID 684 wrote to memory of 1856 684 iexplore.exe IEXPLORE.EXE PID 684 wrote to memory of 1856 684 iexplore.exe IEXPLORE.EXE PID 684 wrote to memory of 1856 684 iexplore.exe IEXPLORE.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
STEALER.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" STEALER.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe"C:\Users\Admin\AppData\Local\Temp\8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe"C:\Users\Admin\AppData\Local\Temp\8ec50a96c6112fc5972b8879d94655091321004fb192060c637a35f026101efa.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STEALER.EXE"C:\Users\Admin\AppData\Local\Temp\STEALER.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STEALER.EXE"C:\Users\Admin\AppData\Local\Temp\STEALER.EXE"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=explorer.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.04⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\STEALER.EXEFilesize
90KB
MD5b2bbb3edba708953fde6536961ecadb6
SHA1a97ded595e565350f9cf7e08a200416a31bca47a
SHA256914165ef4146ac775809b7a2d0c6fb89e15854357841dadf4dd38836360e8b50
SHA5122bcc984e51cd360fd6a88bc5b35abeb32443bebcd6d20763e4d895d86697d17c1cfaa07f4169840472401677074272c26c4e37a6bbe4153c29956c7005b321c9
-
C:\Users\Admin\AppData\Local\Temp\STEALER.EXEFilesize
90KB
MD5b2bbb3edba708953fde6536961ecadb6
SHA1a97ded595e565350f9cf7e08a200416a31bca47a
SHA256914165ef4146ac775809b7a2d0c6fb89e15854357841dadf4dd38836360e8b50
SHA5122bcc984e51cd360fd6a88bc5b35abeb32443bebcd6d20763e4d895d86697d17c1cfaa07f4169840472401677074272c26c4e37a6bbe4153c29956c7005b321c9
-
C:\Users\Admin\AppData\Local\Temp\STEALER.EXEFilesize
90KB
MD5b2bbb3edba708953fde6536961ecadb6
SHA1a97ded595e565350f9cf7e08a200416a31bca47a
SHA256914165ef4146ac775809b7a2d0c6fb89e15854357841dadf4dd38836360e8b50
SHA5122bcc984e51cd360fd6a88bc5b35abeb32443bebcd6d20763e4d895d86697d17c1cfaa07f4169840472401677074272c26c4e37a6bbe4153c29956c7005b321c9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VNSCUVRB.txtFilesize
608B
MD5c2a068245c490f8ca75b2406f659511f
SHA169fb9371202f7950032dbaa9da87ce75e98dec68
SHA256a593a962697d5b8b03e4b7def0943abb7493b338213952ea06d830490aa4a9f1
SHA512b987a765a4e44389209af0890779fe7c7789af12b6f925e75136657c6cbcc109b3945de819ff826492df115558fd7e18fe2b69e286e3e8789312ab623d20e076
-
\Users\Admin\AppData\Local\Temp\STEALER.EXEFilesize
90KB
MD5b2bbb3edba708953fde6536961ecadb6
SHA1a97ded595e565350f9cf7e08a200416a31bca47a
SHA256914165ef4146ac775809b7a2d0c6fb89e15854357841dadf4dd38836360e8b50
SHA5122bcc984e51cd360fd6a88bc5b35abeb32443bebcd6d20763e4d895d86697d17c1cfaa07f4169840472401677074272c26c4e37a6bbe4153c29956c7005b321c9
-
\Users\Admin\AppData\Local\Temp\STEALER.EXEFilesize
90KB
MD5b2bbb3edba708953fde6536961ecadb6
SHA1a97ded595e565350f9cf7e08a200416a31bca47a
SHA256914165ef4146ac775809b7a2d0c6fb89e15854357841dadf4dd38836360e8b50
SHA5122bcc984e51cd360fd6a88bc5b35abeb32443bebcd6d20763e4d895d86697d17c1cfaa07f4169840472401677074272c26c4e37a6bbe4153c29956c7005b321c9
-
\Users\Admin\AppData\Local\Temp\STEALER.EXEFilesize
90KB
MD5b2bbb3edba708953fde6536961ecadb6
SHA1a97ded595e565350f9cf7e08a200416a31bca47a
SHA256914165ef4146ac775809b7a2d0c6fb89e15854357841dadf4dd38836360e8b50
SHA5122bcc984e51cd360fd6a88bc5b35abeb32443bebcd6d20763e4d895d86697d17c1cfaa07f4169840472401677074272c26c4e37a6bbe4153c29956c7005b321c9
-
memory/1104-106-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1104-104-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1104-100-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1104-101-0x00000000004E6626-mapping.dmp
-
memory/1104-98-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/1152-91-0x0000000073AE0000-0x000000007408B000-memory.dmpFilesize
5.7MB
-
memory/1152-78-0x0000000000000000-mapping.dmp
-
memory/1340-61-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-56-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-70-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-75-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-71-0x000000000048E85C-mapping.dmp
-
memory/1340-68-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-66-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-57-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-103-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-59-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-63-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-72-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-95-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1340-65-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1960-96-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1960-86-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1960-84-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1960-83-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1960-87-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1960-107-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1960-88-0x00000000004011D0-mapping.dmp
-
memory/2040-54-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/2040-55-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2040-74-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB