1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2

General

Target

1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
Size

403KB
MD5

a02a2251ae08b1584dbbfeb2bb194410
SHA1

68d06a57a49f329f9c33c96095b6aea23fc262f1
SHA256

1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2
SHA512

d31684aa52bf1b892f05de229d430d31d1776d6e9e814e9dd2d5a4ae15c5a84eb90cc155a59f4db57fa9f057010fe2fcb0eaa35c01a8caf363d64c112da3f73c
SSDEEP

12288:PvqlqSrzEAupLiPuSrN0hMaNeY1yp+4QHISvt:nsqSroAupL8uSrOhMeIKHIS

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\J:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\K:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\P:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\Q:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\S:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\V:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\W:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\L:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\N:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\U:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\F:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\H:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\M:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\O:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\R:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\Y:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\Z:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\E:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\G:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\T:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened (read-only)	\??\X:	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File created	C:\Program Files\7-Zip\Uninstall.ivr	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1084	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
1084	1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe

C:\Users\Admin\AppData\Local\Temp\1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe
"C:\Users\Admin\AppData\Local\Temp\1087e84a7ea67acbcb65f5b880813332262a32b5a677c8dfc76b14c11c47bdc2.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1084-55-0x0000000001000000-0x0000000001083000-memory.dmp

Filesize
524KB

Download
memory/1084-56-0x0000000001000000-0x0000000001083000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing