9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359

General

Target

9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
Size

168KB
MD5

54a8b6e5eed6b5a2ee6464d68b976268
SHA1

1767ffdfaf2aedb258b02cda08df4aff84f0388a
SHA256

9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359
SHA512

5e53f78441c33d84c11552c11a892c4e3d11927344b9d21cc05e052e2c3b1f09f0a1464185b0436e55bd4ab9c33d3a3142df796313eac35145d4f9f92a0d4795
SSDEEP

3072:kfn0AFE98VbOROy3M0cc+qJoxvPVHiTcw6406cBdkTjF5uO/X05s:k8Ay98MIy3M0cc+qmxvNHiTcw67dkO8+

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\9BE10\\F7B9B.exe"	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1724-56-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/840-61-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1724-62-0x0000000000400000-0x0000000000490000-memory.dmp	upx
behavioral1/memory/1644-66-0x0000000000400000-0x0000000000490000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe

description	pid	process	target process
PID 1724 wrote to memory of 840	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 840	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 840	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 840	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 1644	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 1644	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 1644	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
PID 1724 wrote to memory of 1644	1724	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe	9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe

C:\Users\Admin\AppData\Local\Temp\9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
"C:\Users\Admin\AppData\Local\Temp\9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
C:\Users\Admin\AppData\Local\Temp\9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe startC:\Program Files (x86)\LP\9B29\EA5.exe%C:\Program Files (x86)\LP\9B29
2⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe
C:\Users\Admin\AppData\Local\Temp\9b626de147f4db561d384c405819c48111ee6dbd45c6bcd7edcb842069b50359.exe startC:\Program Files (x86)\10252\lvvm.exe%C:\Program Files (x86)\10252
2⤵
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-58-0x0000000000000000-mapping.dmp

Download
memory/840-60-0x00000000002FB000-0x0000000000376000-memory.dmp

Filesize
492KB

Download
memory/840-61-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-63-0x0000000000000000-mapping.dmp

Download
memory/1644-65-0x000000000062B000-0x00000000006A6000-memory.dmp

Filesize
492KB

Download
memory/1644-66-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1724-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1724-55-0x00000000006AB000-0x0000000000726000-memory.dmp

Filesize
492KB

Download
memory/1724-56-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1724-57-0x00000000006AB000-0x0000000000726000-memory.dmp

Filesize
492KB

Download
memory/1724-62-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads