3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb

General

Target

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
Size

25KB
MD5

c01537f99d2eb404e1acebebfbc0bd52
SHA1

3121806fe93b25b72d6bc28af7b092a4ba63b4a1
SHA256

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb
SHA512

f2b072f55e4fa04d7983c6d639a692d437261662fb580aaf170ab8796c1b2cf2323d24da771886d526979bb81e534ef91813baebfd0ade276b20c3cbcf0f0ec0
SSDEEP

384:V1u6MKacGQabT2JKQ10NyXao0/QK0Iom5YSgMxrIUvwZ+x/kIGGhqwptB0B0Yy:vukaDL6JZu0m/QKvu7UrI1Z+x/kBrB0

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

pid process

4416 3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

pid	process
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Drops startup file 3 IoCs

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 whatismyip.akamai.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
8	whatismyip.akamai.com

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

pid	process
4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

description	pid	process	target process
PID 4528 wrote to memory of 4416	4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
PID 4528 wrote to memory of 4416	4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
PID 4528 wrote to memory of 4416	4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
PID 4528 wrote to memory of 4944	4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	cmd.exe
PID 4528 wrote to memory of 4944	4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	cmd.exe
PID 4528 wrote to memory of 4944	4528	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	cmd.exe
PID 4416 wrote to memory of 4888	4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	cmd.exe
PID 4416 wrote to memory of 4888	4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	cmd.exe
PID 4416 wrote to memory of 4888	4416	3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
"C:\Users\Admin\AppData\Local\Temp\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe"
1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe" >> NUL
3⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe" >> NUL
2⤵
PID:4944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

4

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Filesize
25KB

MD5
c01537f99d2eb404e1acebebfbc0bd52

SHA1
3121806fe93b25b72d6bc28af7b092a4ba63b4a1

SHA256
3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb

SHA512
f2b072f55e4fa04d7983c6d639a692d437261662fb580aaf170ab8796c1b2cf2323d24da771886d526979bb81e534ef91813baebfd0ade276b20c3cbcf0f0ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb.exe

Filesize
25KB

MD5
c01537f99d2eb404e1acebebfbc0bd52

SHA1
3121806fe93b25b72d6bc28af7b092a4ba63b4a1

SHA256
3250cee335d6a0948375be04338d6e259f46a20c1b0a2d658be50a31ab497bfb

SHA512
f2b072f55e4fa04d7983c6d639a692d437261662fb580aaf170ab8796c1b2cf2323d24da771886d526979bb81e534ef91813baebfd0ade276b20c3cbcf0f0ec0

Download Submit
memory/4416-133-0x0000000000000000-mapping.dmp

Download
memory/4416-137-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4416-139-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4416-141-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4528-132-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4528-138-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4888-140-0x0000000000000000-mapping.dmp

Download
memory/4944-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads