ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4

General

Target

ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe
Size

56KB
MD5

74a74854535bc0e540151baedf0cc810
SHA1

97e6088262fe08073efe6fbd4c3110549267359f
SHA256

ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4
SHA512

c62bae70ed3631404730ce91f3e22241213e5a98b8101190ec4f31faa2185ef32ace266987bd0d9dfcd9996101fd68d48a1d5c5d4e5d5aa58ef83843a3994dcc
SSDEEP

768:zj6mzjp5ozbIDXjV60X4yTP4iXqX5eVVoOhBfvCq5n:Bp5ogjV6KTPHA5eXomk

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
32	4364	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
5024	TalkSmile.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	TalkSmile.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	TalkSmile.exe
File opened (read-only)	\??\G:	TalkSmile.exe
File opened (read-only)	\??\H:	TalkSmile.exe
File opened (read-only)	\??\I:	TalkSmile.exe
File opened (read-only)	\??\Q:	TalkSmile.exe
File opened (read-only)	\??\J:	TalkSmile.exe
File opened (read-only)	\??\M:	TalkSmile.exe
File opened (read-only)	\??\T:	TalkSmile.exe
File opened (read-only)	\??\Y:	TalkSmile.exe
File opened (read-only)	\??\Z:	TalkSmile.exe
File opened (read-only)	\??\L:	TalkSmile.exe
File opened (read-only)	\??\N:	TalkSmile.exe
File opened (read-only)	\??\U:	TalkSmile.exe
File opened (read-only)	\??\V:	TalkSmile.exe
File opened (read-only)	\??\X:	TalkSmile.exe
File opened (read-only)	\??\R:	TalkSmile.exe
File opened (read-only)	\??\S:	TalkSmile.exe
File opened (read-only)	\??\W:	TalkSmile.exe
File opened (read-only)	\??\B:	TalkSmile.exe
File opened (read-only)	\??\E:	TalkSmile.exe
File opened (read-only)	\??\K:	TalkSmile.exe
File opened (read-only)	\??\O:	TalkSmile.exe
File opened (read-only)	\??\P:	TalkSmile.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TalkSmile.exe	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe
File opened for modification	C:\Windows\SysWOW64\TalkSmile.exe	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3132	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3132	explorer.exe
3132	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 3408	3284	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe	82
PID 3284 wrote to memory of 3408	3284	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe	82
PID 3284 wrote to memory of 3408	3284	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe	82
PID 3284 wrote to memory of 5024	3284	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe	83
PID 3284 wrote to memory of 5024	3284	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe	83
PID 3284 wrote to memory of 5024	3284	ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe	83
PID 5024 wrote to memory of 4364	5024	TalkSmile.exe	92
PID 5024 wrote to memory of 4364	5024	TalkSmile.exe	92
PID 5024 wrote to memory of 4364	5024	TalkSmile.exe	92

C:\Users\Admin\AppData\Local\Temp\ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe
"C:\Users\Admin\AppData\Local\Temp\ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4
  2⤵
  PID:3408
- C:\Windows\SysWOW64\TalkSmile.exe
  C:\Windows\system32\TalkSmile.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" c:\SendMail.vbs
    3⤵
    - Blocklisted process makes network request
    PID:4364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\TalkSmile.exe

Filesize
56KB

MD5
74a74854535bc0e540151baedf0cc810

SHA1
97e6088262fe08073efe6fbd4c3110549267359f

SHA256
ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4

SHA512
c62bae70ed3631404730ce91f3e22241213e5a98b8101190ec4f31faa2185ef32ace266987bd0d9dfcd9996101fd68d48a1d5c5d4e5d5aa58ef83843a3994dcc

Download Submit
C:\Windows\SysWOW64\TalkSmile.exe

Filesize
56KB

MD5
74a74854535bc0e540151baedf0cc810

SHA1
97e6088262fe08073efe6fbd4c3110549267359f

SHA256
ea59a35fa0c519455f3ba648389c72b1f689429aa8411592b0b89c257d3241c4

SHA512
c62bae70ed3631404730ce91f3e22241213e5a98b8101190ec4f31faa2185ef32ace266987bd0d9dfcd9996101fd68d48a1d5c5d4e5d5aa58ef83843a3994dcc

Download Submit
\??\c:\SendMail.vbs

Filesize
718B

MD5
9c4cd2fe51f818ac3dc160cd69907538

SHA1
ed87fc409b2bb75d8c0e3e86094767fbc18c00e1

SHA256
e07085d23ec6c47365c03969413df8db6e28617a1d408792df2a72504cf58706

SHA512
0f18427845df90cda8f16dd48eec5ecc7d4fddc95924a075a9deba2eae3e055f871c80605f81dcfec31f54cdfe12ba3d69e2020eade35fc15f2be220119d2817

Download Submit
memory/3284-132-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3284-138-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5024-137-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/5024-139-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads