c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58

General

Target

c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Size

75KB
MD5

0624afe6cf80c392171a4f0ece3a2490
SHA1

16f675b48f839e5ab21073b3d9e06a4560b94201
SHA256

c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58
SHA512

0325c887510a0fdfc4a2840e376cc82ed8371dfe8109f2d5efe191b2741e6b197eb5d078feaf9236b7e655fdfc26b04c87ad474beebb72f2577f872becb08117
SSDEEP

1536:OqBwbLWJLJFKqAZzrZA4kJJYWQEa3BUfjFfa0cgEXhT:OqBFJLzgOJJJQEaGBfa0f0T

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
364	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kyayadiannao"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag\Param1 = "http://www.2345.com/?kyayadiannao"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag\command = "Ñ¾Ñ¾µçÄÔ ÊÖ»ú:13839187291"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\CLSID = "{3f454f0e-42ae-4d7c-8ea3-328250d6e272}"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag\method = "ShellExecute"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\Instance\InitPropertyBag\CLSID = "{13709620-C279-11CE-A49E-444553540000}"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32\ = "C:\\WINDOWS\\SysWow64\\shdocvw.dll"	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 608	364	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe	79
PID 364 wrote to memory of 608	364	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe	79
PID 364 wrote to memory of 608	364	c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe	79

C:\Users\Admin\AppData\Local\Temp\c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe
"C:\Users\Admin\AppData\Local\Temp\c362245babb0721131d1db6da9fe9fd96eb8d3a26400a73857bae2daac3a7c58.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ÇåÀíÀ¬»øÎÄ¼þ.bat
  2⤵
  PID:608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsqA29F.tmp\nsExec.dll

Filesize
6KB

MD5
e54eb27fb5048964e8d1ec7a1f72334b

SHA1
2b76d7aedafd724de96532b00fbc6c7c370e4609

SHA256
ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

SHA512
c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ÇåÀíÀ¬»øÎÄ¼þ.bat

Filesize
929B

MD5
1ba10780f469de4f9830ed93447841a2

SHA1
3953f49b53d5fcfdff697eae30168fec9f92cb14

SHA256
b09dd5b3b98bea65dc848e04b5b9bffa5f8fb5f2f95fda1f0ae8108289a00308

SHA512
9e6b5e446dcdb156744d97c6acca72af38851411852aa0c78dcbd094a673be371d6749cf187e8b64518da621f47125390c72660b5ec9426a0392ba04dfbd1f61

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads