af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15

General

Target

af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe
Size

96KB
MD5

a3a0b88deeaa3068f30327007f9f6340
SHA1

d02fd9a3e3fdd6c062c2a313477388f842988e05
SHA256

af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15
SHA512

32c3ef21ba40094199e21eb0708a18ce0b6dda32448653e33180685acea7915f703da0fcd070e9ee47eae655c5e44bad90380032e3e0f84ef30488414e48232e
SSDEEP

1536:1/BmvfC96Kfh5jvRnrXok2KLGmOmLGYJXjO7HUEotQtGDewOWeA:1/2OjJnrXokZTJXS7EQtGDDt5

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
980	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\buEM7K18KXRg6AVV5wQS6BBRgGbKHn.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\buEM7K18KXRg6AVV5wQS6BBRgGbKHn.exe	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
980	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe
Token: SeDebugPrivilege	980	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe
980	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 980	1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe	27
PID 1500 wrote to memory of 980	1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe	27
PID 1500 wrote to memory of 980	1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe	27
PID 1500 wrote to memory of 980	1500	af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe	27

C:\Users\Admin\AppData\Local\Temp\af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe
"C:\Users\Admin\AppData\Local\Temp\af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe
  "C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe

Filesize
96KB

MD5
a3a0b88deeaa3068f30327007f9f6340

SHA1
d02fd9a3e3fdd6c062c2a313477388f842988e05

SHA256
af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15

SHA512
32c3ef21ba40094199e21eb0708a18ce0b6dda32448653e33180685acea7915f703da0fcd070e9ee47eae655c5e44bad90380032e3e0f84ef30488414e48232e

Download Submit
C:\Users\Admin\AppData\Roaming\InstallDir\svchost.exe

Filesize
96KB

MD5
a3a0b88deeaa3068f30327007f9f6340

SHA1
d02fd9a3e3fdd6c062c2a313477388f842988e05

SHA256
af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15

SHA512
32c3ef21ba40094199e21eb0708a18ce0b6dda32448653e33180685acea7915f703da0fcd070e9ee47eae655c5e44bad90380032e3e0f84ef30488414e48232e

Download Submit
\Users\Admin\AppData\Roaming\InstallDir\svchost.exe

Filesize
96KB

MD5
a3a0b88deeaa3068f30327007f9f6340

SHA1
d02fd9a3e3fdd6c062c2a313477388f842988e05

SHA256
af8c6a1d7ff31b60221b64c90b98232dbe0def2bddbaa5824f61947b26f9cd15

SHA512
32c3ef21ba40094199e21eb0708a18ce0b6dda32448653e33180685acea7915f703da0fcd070e9ee47eae655c5e44bad90380032e3e0f84ef30488414e48232e

Download Submit
memory/980-62-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/980-63-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/1500-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1500-55-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download
memory/1500-61-0x0000000074350000-0x00000000748FB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing