a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963

General

Target

a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe
Size

919KB
MD5

b9bdddad2b53c887db96319aa30676c2
SHA1

e5f58be19497eb1622ee356a38977a4e6af52f61
SHA256

a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963
SHA512

17a120aa1d6a26106453d7ec292bb4e9808193eadc862525ed5f9903c0d8552d02338415489aa7fc5283b461a88435ed9385394a4092c4b116dcdf02ea413926
SSDEEP

24576:4Uac7EJEhlpyouGViLlvOMjoJFRJHJ2rHbX/:427E4LDVQvOMjoRJpOHT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
560	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1"	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28
PID 1336 wrote to memory of 560	1336	a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe	28

C:\Users\Admin\AppData\Local\Temp\a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe
"C:\Users\Admin\AppData\Local\Temp\a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\a2L3HeC1pB\3W9GWyBk\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\a2L3HeC1pB\3W9GWyBk\Setup.exe" --relaunch
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a2L3HeC1pB\3W9GWyBk\Setup.exe

Filesize
919KB

MD5
b9bdddad2b53c887db96319aa30676c2

SHA1
e5f58be19497eb1622ee356a38977a4e6af52f61

SHA256
a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963

SHA512
17a120aa1d6a26106453d7ec292bb4e9808193eadc862525ed5f9903c0d8552d02338415489aa7fc5283b461a88435ed9385394a4092c4b116dcdf02ea413926

Download Submit
C:\Users\Admin\AppData\Local\Temp\a2L3HeC1pB\3W9GWyBk\Setup.exe

Filesize
919KB

MD5
b9bdddad2b53c887db96319aa30676c2

SHA1
e5f58be19497eb1622ee356a38977a4e6af52f61

SHA256
a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963

SHA512
17a120aa1d6a26106453d7ec292bb4e9808193eadc862525ed5f9903c0d8552d02338415489aa7fc5283b461a88435ed9385394a4092c4b116dcdf02ea413926

Download Submit
\Users\Admin\AppData\Local\Temp\a2L3HeC1pB\3W9GWyBk\Setup.exe

Filesize
919KB

MD5
b9bdddad2b53c887db96319aa30676c2

SHA1
e5f58be19497eb1622ee356a38977a4e6af52f61

SHA256
a5aa365d6d346a7fe83c8e4c8f8d8a955c7bc93ddeae5ede4e94d0794d4bb963

SHA512
17a120aa1d6a26106453d7ec292bb4e9808193eadc862525ed5f9903c0d8552d02338415489aa7fc5283b461a88435ed9385394a4092c4b116dcdf02ea413926

Download Submit
memory/1336-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing