84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c

General

Target

84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe
Size

758KB
MD5

81a370473c4ff6da18b2f4c4fe7d9bfe
SHA1

560cdcb52853d2373e39419d20c314166cb858d4
SHA256

84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c
SHA512

4c62fc999a3bbbb06492b88da8b3b6190041e5e78c9fe7929900b8af587a3b977816a8617d679696011f83721149c3acd6614091f05a243ee6881a39f8b7859c
SSDEEP

6144:gxc4a/N7TB+rrUri2YiQdNBq31LAJ2R4zFuHaoTFuHao3FuHao:gxlaF7TcrrUri7tNRJ2R4ztstAt

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

1.exe

pid process

908 1.exe

pid	process
908	1.exe

Drops startup file 2 IoCs

Processes:

84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

Loads dropped DLL 2 IoCs

Processes:

84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

pid	process
756	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe
756	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

pid process

756 84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe

description	pid	process	target process
PID 756 wrote to memory of 908	756	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe	1.exe
PID 756 wrote to memory of 908	756	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe	1.exe
PID 756 wrote to memory of 908	756	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe	1.exe
PID 756 wrote to memory of 908	756	84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe	1.exe

C:\Users\Admin\AppData\Local\Temp\84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe
"C:\Users\Admin\AppData\Local\Temp\84c9fef64882ff6362bbb019edd4db383965eb2bcf75aca832b01b8ef91ba78c.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
2⤵
- Executes dropped EXE
PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
620KB

MD5
69337cff41a1860439f294a9e340cc7e

SHA1
b7fc608f41868943edfe1df01e922287bb311c2c

SHA256
25edd3c1a5b10376d679f0072e8ee3805289bad89e38273d721408e43f5a14e5

SHA512
db6d6de190299a34beb9a86afa29081352fe8e914998a62a8fac1939d23694972762a2d003a757ef2dba9e039a9c9f516696c93197539316ddc3df3cc43180f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe

Filesize
620KB

MD5
69337cff41a1860439f294a9e340cc7e

SHA1
b7fc608f41868943edfe1df01e922287bb311c2c

SHA256
25edd3c1a5b10376d679f0072e8ee3805289bad89e38273d721408e43f5a14e5

SHA512
db6d6de190299a34beb9a86afa29081352fe8e914998a62a8fac1939d23694972762a2d003a757ef2dba9e039a9c9f516696c93197539316ddc3df3cc43180f0

Download Submit
\Users\Admin\AppData\Local\Temp\1.exe

Filesize
620KB

MD5
69337cff41a1860439f294a9e340cc7e

SHA1
b7fc608f41868943edfe1df01e922287bb311c2c

SHA256
25edd3c1a5b10376d679f0072e8ee3805289bad89e38273d721408e43f5a14e5

SHA512
db6d6de190299a34beb9a86afa29081352fe8e914998a62a8fac1939d23694972762a2d003a757ef2dba9e039a9c9f516696c93197539316ddc3df3cc43180f0

Download Submit
\Users\Admin\AppData\Local\Temp\1.exe

Filesize
620KB

MD5
69337cff41a1860439f294a9e340cc7e

SHA1
b7fc608f41868943edfe1df01e922287bb311c2c

SHA256
25edd3c1a5b10376d679f0072e8ee3805289bad89e38273d721408e43f5a14e5

SHA512
db6d6de190299a34beb9a86afa29081352fe8e914998a62a8fac1939d23694972762a2d003a757ef2dba9e039a9c9f516696c93197539316ddc3df3cc43180f0

Download Submit
memory/756-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/908-57-0x0000000000000000-mapping.dmp

Download
memory/908-61-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/908-62-0x0000000000476000-0x0000000000487000-memory.dmp

Filesize
68KB

Download
memory/908-63-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/908-64-0x0000000000476000-0x0000000000487000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads