ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132

General

Target

ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe
Size

96KB
MD5

4809009fe0216997581564d7e5c9a6e4
SHA1

66760122fc8a7527db089eb5d288338dc4756a09
SHA256

ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132
SHA512

a18f582731d4cf09eafd696a807abd287d7305a847596fe8e85fcc5bcf9fe1d6fe00b8fdcdf09a2f6ae86a313568d0f76bc2d725e226ca0eb6c545b233f545dd
SSDEEP

1536:e4qhBTyE/0nehr7FTquJ3Ue6Qt2I1m/bHTJKqOh:83lxTbJ3UXQlOTJK5h

Score

10^/10

persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
ronin1721956480

Signatures

Executes dropped EXE 1 IoCs

pid	Process
616	explorerr.exe

Loads dropped DLL 1 IoCs

pid	Process
1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorerr = "C:\\Users\\Admin\\AppData\\Roaming\\explorerr.exe"	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
616	explorerr.exe
616	explorerr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe
Token: SeDebugPrivilege	616	explorerr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe
616	explorerr.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 616	1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe	28
PID 1824 wrote to memory of 616	1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe	28
PID 1824 wrote to memory of 616	1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe	28
PID 1824 wrote to memory of 616	1824	ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe	28

C:\Users\Admin\AppData\Local\Temp\ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe
"C:\Users\Admin\AppData\Local\Temp\ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Roaming\explorerr.exe
  "C:\Users\Admin\AppData\Roaming\explorerr.exe" ONCE
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\explorerr.exe

Filesize
96KB

MD5
4809009fe0216997581564d7e5c9a6e4

SHA1
66760122fc8a7527db089eb5d288338dc4756a09

SHA256
ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132

SHA512
a18f582731d4cf09eafd696a807abd287d7305a847596fe8e85fcc5bcf9fe1d6fe00b8fdcdf09a2f6ae86a313568d0f76bc2d725e226ca0eb6c545b233f545dd

Download Submit
C:\Users\Admin\AppData\Roaming\explorerr.exe

Filesize
96KB

MD5
4809009fe0216997581564d7e5c9a6e4

SHA1
66760122fc8a7527db089eb5d288338dc4756a09

SHA256
ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132

SHA512
a18f582731d4cf09eafd696a807abd287d7305a847596fe8e85fcc5bcf9fe1d6fe00b8fdcdf09a2f6ae86a313568d0f76bc2d725e226ca0eb6c545b233f545dd

Download Submit
\Users\Admin\AppData\Roaming\explorerr.exe

Filesize
96KB

MD5
4809009fe0216997581564d7e5c9a6e4

SHA1
66760122fc8a7527db089eb5d288338dc4756a09

SHA256
ce7693688ab545f0bed2d6caad602e59f7fde5327196019a561c796b29885132

SHA512
a18f582731d4cf09eafd696a807abd287d7305a847596fe8e85fcc5bcf9fe1d6fe00b8fdcdf09a2f6ae86a313568d0f76bc2d725e226ca0eb6c545b233f545dd

Download Submit
memory/616-62-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/616-63-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1824-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1824-55-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1824-61-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing