5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb.exe
Size

800KB
MD5

93a272c541a560657ed60b4e97279650
SHA1

dfa55ed40a02f403d28fa0a948d192e0db4207fe
SHA256

5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb
SHA512

0dfefd6a2db5f04615ccc313c43d9678b690193d3c369bfdecf95ed0a7658a30c50046af19621ec840f5c1eb89afe0c8bec1c81861c56280432bec0f042a7138
SSDEEP

12288:0yQA48IBGcwtgT+seLki1ozgfXFVOs/QQRLM43tAlnwmSaTjSbGXZyJPjdP:0yQrDT+HLTxXFEERLMa4SaTeGpyp

Score

8^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1204-55-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/1204-56-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/1204-58-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/1204-59-0x0000000000400000-0x0000000000623000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SonyAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb.exe"	5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb.exe
"C:\Users\Admin\AppData\Local\Temp\5cd9df1fdc2c62508ad7d9aa67cdf31b5779174334a01229050f553d610822bb.exe"
1⤵
- Adds Run key to start application
PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download
memory/1204-55-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download
memory/1204-56-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download
memory/1204-57-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1204-58-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download
memory/1204-59-0x0000000000400000-0x0000000000623000-memory.dmp

Filesize
2.1MB

Download