d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb

General

Target

d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Size

77KB
MD5

1a60084623590d651a2b0d2b788c4083
SHA1

66ce829478b04feaa55433735caf8144d14663b1
SHA256

d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb
SHA512

8d8f2318aaef017eb58eabecd844c4b22176e278afbe3f6739e85234a61d24ffaad16d8e471c2316772c027e26377cea9084f46270121b686fcb26813a148308
SSDEEP

1536:raHLtZfByDUJuSkZWeGkqbT3ckFqtWUOQp2HqgVIZKzKAIRPwtuYwPw:raHzB+UJBOQksAkItqQpSVIAzx4wtYo

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\SearchScopes	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadUpdates = "398336"	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://www.google.com/cse?cx=partner-pub-9588033570232632:rhmyra-cwbb&q={searchTerms}"	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.google.com/cse?cx=partner-pub-9588033570232632:rhmyra-cwbb&q={searchTerms}"	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Google"	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "file://localhost/C:/www.google.com.htm"	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
2020	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 1860 wrote to memory of 2020	1860	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	28
PID 2020 wrote to memory of 1216	2020	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	15
PID 2020 wrote to memory of 1216	2020	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	15
PID 2020 wrote to memory of 1216	2020	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	15
PID 2020 wrote to memory of 1216	2020	d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
  "C:\Users\Admin\AppData\Local\Temp\d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
    C:\Users\Admin\AppData\Local\Temp\d34d26893b22c2359c2cea6e3f70ebda3d089016aba40c2a629cb078b8077eeb.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2020-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2020-61-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2020-62-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/2020-66-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads