fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4

General

Target

fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe
Size

96KB
MD5

df98945b6c86747e57e1fa6f5c74e76f
SHA1

d9f5e5c1f337403812b7c3ee28287f74d1868fd4
SHA256

fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4
SHA512

5cb5414e17766b8a053544a9e5128f0b091c1ed771132c6f6b787b0d7272991c7476b84cbad8bea23719c2c68231ad69d14f8a861a747abcfe81e407dfdfff9c
SSDEEP

1536:9/BmvfOrCfhnjQRN9P5odNKomadte1XjO7HUEotQtGDewkWej:9/2RjeNx5ov+1XS7EQtGDDfq

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1508 svchost.exe
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1508 svchost.exe

pid	process
1508	svchost.exe

pid	process
1508	svchost.exe

Drops startup file 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3JmC5bbKHp31GBLXgOnKl35YjlfPKX.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3JmC5bbKHp31GBLXgOnKl35YjlfPKX.exe	svchost.exe

Loads dropped DLL 1 IoCs

Processes:

fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe

pid process

1156 fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\host\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe

description pid process

Token: SeDebugPrivilege 1156 fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exesvchost.exe

pid process

1156 fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe
1508 svchost.exe

description	pid	process
Token: SeDebugPrivilege	1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe

pid	process
1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe
1508	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe

description	pid	process	target process
PID 1156 wrote to memory of 1508	1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe	svchost.exe
PID 1156 wrote to memory of 1508	1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe	svchost.exe
PID 1156 wrote to memory of 1508	1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe	svchost.exe
PID 1156 wrote to memory of 1508	1156	fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe
"C:\Users\Admin\AppData\Local\Temp\fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Roaming\host\svchost.exe
"C:\Users\Admin\AppData\Roaming\host\svchost.exe"
2⤵
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\melt.Tmp
Filesize
102B

MD5
a319f4b1153c420746085be5b6b28fa2

SHA1
47cb7fc62cb7143f2689e79afaef13d86b828420

SHA256
b5a25b8f1bba0366b318180313d3298e81b66510a4e425cc988ff6c5be579aeb

SHA512
d373f392d1e6ebc7b3f275225978f4a12813a792f753e7e15b78a95f89022eddeeb2ca3013aeda0cf95b60cde8732d841686395da63377b9723bb7b094f32485

Download Submit
C:\Users\Admin\AppData\Roaming\host\svchost.exe
Filesize
96KB

MD5
df98945b6c86747e57e1fa6f5c74e76f

SHA1
d9f5e5c1f337403812b7c3ee28287f74d1868fd4

SHA256
fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4

SHA512
5cb5414e17766b8a053544a9e5128f0b091c1ed771132c6f6b787b0d7272991c7476b84cbad8bea23719c2c68231ad69d14f8a861a747abcfe81e407dfdfff9c

Download Submit
C:\Users\Admin\AppData\Roaming\host\svchost.exe
Filesize
96KB

MD5
df98945b6c86747e57e1fa6f5c74e76f

SHA1
d9f5e5c1f337403812b7c3ee28287f74d1868fd4

SHA256
fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4

SHA512
5cb5414e17766b8a053544a9e5128f0b091c1ed771132c6f6b787b0d7272991c7476b84cbad8bea23719c2c68231ad69d14f8a861a747abcfe81e407dfdfff9c

Download Submit
\Users\Admin\AppData\Roaming\host\svchost.exe
Filesize
96KB

MD5
df98945b6c86747e57e1fa6f5c74e76f

SHA1
d9f5e5c1f337403812b7c3ee28287f74d1868fd4

SHA256
fb4544627036d5824f37a0f541e604b67208062c7aaddaf26c6f2174b95e41f4

SHA512
5cb5414e17766b8a053544a9e5128f0b091c1ed771132c6f6b787b0d7272991c7476b84cbad8bea23719c2c68231ad69d14f8a861a747abcfe81e407dfdfff9c

Download Submit
memory/1156-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1156-55-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1156-56-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1156-62-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-58-0x0000000000000000-mapping.dmp

Download
memory/1508-63-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-65-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads