fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c

General

Target

fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
Size

178KB
MD5

cd71a536fa269bac132a0e6ec49b9cb9
SHA1

999211ae5740a91de436843928f46ea4304a30b0
SHA256

fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c
SHA512

875be4e10dc3194fa3f6cbc4c7b111e9e3745419397a3a1d2149a538c6e3fb7d20e53b0bee4358621dfdd99654cc53f7604cc216154aef87d21ece487bf747e4
SSDEEP

3072:ST+PzecO+bW/phOhzSPkMYWdH9kXID+PIqm2v4XNlMUhR44Y6j5W3UFKoL7KwkCD:SP+MhctPWpsAqp4jMUhRTY69WkjeCj/

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\conhost.exe"	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1484-55-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1400-60-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1700-64-0x0000000000400000-0x0000000000490000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe

description	pid	process	target process
PID 1484 wrote to memory of 1400	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1400	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1400	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1400	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1700	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1700	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1700	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
PID 1484 wrote to memory of 1700	1484	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe	fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe

C:\Users\Admin\AppData\Local\Temp\fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
"C:\Users\Admin\AppData\Local\Temp\fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
  C:\Users\Admin\AppData\Local\Temp\fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe startC:\Users\Admin\AppData\Roaming\Microsoft\csrss.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  PID:1400
- C:\Users\Admin\AppData\Local\Temp\fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe
  C:\Users\Admin\AppData\Local\Temp\fba191484a3f0e69d753fe3fb49607f50e55a29924626a8578820a1d3fc94c2c.exe startC:\Windows\system32\lvvm.exe%C:\Windows\system32
  2⤵
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-58-0x0000000000000000-mapping.dmp

Download
memory/1400-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1400-61-0x0000000000581000-0x000000000059B000-memory.dmp

Filesize
104KB

Download
memory/1484-54-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1484-55-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1484-56-0x0000000000581000-0x000000000059B000-memory.dmp

Filesize
104KB

Download
memory/1484-57-0x0000000000581000-0x000000000059B000-memory.dmp

Filesize
104KB

Download
memory/1700-62-0x0000000000000000-mapping.dmp

Download
memory/1700-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1700-65-0x00000000002D1000-0x00000000002EB000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads