4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d

General

Target

4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
Size

1.1MB
MD5

54d188a38d0d38eee7216922a3e840c1
SHA1

bf40d686bf119888cae7fab2041a33ed62a85869
SHA256

4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d
SHA512

7c1b7b65968a6ed1c5390f339ccb94f0e23212aea883574737ce4785705ed02ddd867267601305e37d0ce7c3d5a4a68291dba8e847739d40c59f6373f5b1d203
SSDEEP

24576:/X/eO4qw611ZlZ38YrKkEROaL3v9Xjrh1TqJk9:+O4ps1ZrbhEYUFXjFtm2

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\klist.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe

pid process

4748 4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe

pid	process
4748	4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe

C:\Users\Admin\AppData\Local\Temp\4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe
"C:\Users\Admin\AppData\Local\Temp\4b27b11701633a98c69244e510f441228c45a17500e58e0060bd99d04d011a8d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads