aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 23:43

Target

aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
Size

194KB
MD5

1de1c907f9ca6a9e800e1ef9213a56e9
SHA1

0792859d5a37d5abd0cf052160e820fb5c82f7d5
SHA256

aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52
SHA512

b4a18fafea3b7680db1dd023e059c991b6ad2e69e4d21f18bda10b2acd32744b94becaeb8cc6d0022a247858c6b34b689b77796cbf1e3ebb4bb5beddb1049601
SSDEEP

3072:LBq/nm9wMK4q+GIhb9wlzcpI+HnNQkBa0WEcXxTtCCxv0kjlgu9O:MnWhVthbalzAI+HqiaEcXZRXD

Score

8^/10

spyware stealer upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1960-55-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1960-57-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1240-61-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral1/memory/1856-65-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe

description	pid	process	target process
PID 1960 wrote to memory of 1240	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1240	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1240	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1240	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1856	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1856	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1856	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 1960 wrote to memory of 1856	1960	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe

C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
"C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
2⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
2⤵
PID:1856

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/1240-59-0x0000000000000000-mapping.dmp

Download
memory/1240-61-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1240-62-0x000000000055E000-0x000000000057D000-memory.dmp

Filesize
124KB

Download
memory/1856-63-0x0000000000000000-mapping.dmp

Download
memory/1856-65-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1856-66-0x000000000051E000-0x000000000053D000-memory.dmp

Filesize
124KB

Download
memory/1960-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1960-56-0x000000000064E000-0x000000000066D000-memory.dmp

Filesize
124KB

Download
memory/1960-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1960-58-0x000000000064E000-0x000000000066D000-memory.dmp

Filesize
124KB

Download