872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c

Analysis

max time kernel
151s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c.exe
Size

145KB
MD5

81f3690eb4867cb7f68fd7cf466aca45
SHA1

b07ccede4deda152beeeb200486ce7c69db8d986
SHA256

872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c
SHA512

8f2f8901e85d65de7ee7b77d757ddfda558e3ac7f12b2ba1b6fd45936684c0ff5f3112d8e793c1666bab62c287ac6971021b6827667bf1948f3387b39c4db678
SSDEEP

3072:L6+1YBJm1vNzEpnGXxb/t3Z8ylznNcQm6A8Do/xnqgE:L6oAJQvNopnGL3BSU8/NW

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c.exe"	872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c.exe

C:\Users\Admin\AppData\Local\Temp\872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c.exe
"C:\Users\Admin\AppData\Local\Temp\872e9ac53001d93f2c9f568656a96846e37bb8b5752d304fc0500928f62a167c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-54-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-56-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-57-0x00000000009D6000-0x00000000009E7000-memory.dmp

Filesize
68KB

Download
memory/1348-58-0x00000000009D6000-0x00000000009E7000-memory.dmp

Filesize
68KB

Download