e588a8b0aacd3962de5313909c4a97df167c92894a0f8df148788868af1a0580

Analysis

max time kernel
133s
max time network
159s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:38

Target

Cita.pdf.dll
Size

228KB
MD5

8b35142067b0407d7ecb0efed87c404b
SHA1

192a0ce1dc533fc242266500753799b139703aa0
SHA256

4404e2c94e985a381ad5bf708cb2b29f75f793ff405c9c486360fbb628e34eb2
SHA512

0050d975e6a6ac9197a935021761ecfa2967a1e71882ba3154d7caab150805e6eb7532eb554aa2b6be478be7fadc2974d21f441da87002c3b654cce69c854dca
SSDEEP

3072:ck7Bl5GB0wzgpBWwmCzOqXN7m1tMG5WYdpAPGRA4VXVJhJ8Pnl65KLzQ:ck7Bl5GuygywmCx7lA+PGrVXVLOf1M

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1064 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1064	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe
PID 1032 wrote to memory of 1064	1032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cita.pdf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cita.pdf.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1064-54-0x0000000000000000-mapping.dmp

Download
memory/1064-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x0000000000780000-0x000000000080D000-memory.dmp

Filesize
564KB

Download
memory/1064-57-0x0000000000780000-0x000000000080D000-memory.dmp

Filesize
564KB

Download