64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8

General

Target

64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
Size

382KB
MD5

25613387f36fb113b44e2e605c972506
SHA1

d5671b8a1452f7bb313c4fc92f14067a4955de98
SHA256

64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8
SHA512

33a01f60ac8429e3597b37a1b9d9dfe5f7540aa39902750712d8e0cced7433154da400f05d31c33fe0da55b78bce1bc46f50bd969863e445ce2c7a189db2834d
SSDEEP

6144:HsXlEDqr27kUVys+JhV+fOi8DBPs1iw8BBCNRPhF7SLsE66HHNIU:E+uJ4fqOfObDNFaiLd66n7

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 8 IoCs

Processes:

64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe

pid	process
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}\id0 = "23112022"	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe

pid	process
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
1976	64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe

C:\Users\Admin\AppData\Local\Temp\64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe
"C:\Users\Admin\AppData\Local\Temp\64f787832814d3b1661318e5be7ae57b9563a346a92a084956d7746652e62da8.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstF74D.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\inetc3.dll

Filesize
25KB

MD5
9d8ce05f532dc7b5742831ec8a63c2d8

SHA1
b014365f723c78a84bcdf8a46cfa016eb2b8dbc5

SHA256
fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982

SHA512
98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\inetc3.dll

Filesize
25KB

MD5
9d8ce05f532dc7b5742831ec8a63c2d8

SHA1
b014365f723c78a84bcdf8a46cfa016eb2b8dbc5

SHA256
fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982

SHA512
98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\inetc3.dll

Filesize
25KB

MD5
9d8ce05f532dc7b5742831ec8a63c2d8

SHA1
b014365f723c78a84bcdf8a46cfa016eb2b8dbc5

SHA256
fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982

SHA512
98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\inetc3.dll

Filesize
25KB

MD5
9d8ce05f532dc7b5742831ec8a63c2d8

SHA1
b014365f723c78a84bcdf8a46cfa016eb2b8dbc5

SHA256
fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982

SHA512
98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe

Download Submit
\Users\Admin\AppData\Local\Temp\nstF74D.tmp\nsDialogs.dll

Filesize
9KB

MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/1976-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads