c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb

Analysis

max time kernel
235s
max time network
225s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe
Size

931KB
MD5

0a5db531ed3cd492bcd7fa6ee5549b28
SHA1

09f0ce82d767f3095736cb1df23f10c58dc5610e
SHA256

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb
SHA512

ae649d0e6ab5905f0bd635325bad65cbd20de02ea838473d49cfcc3b1e71095e0985223733d2475a7ce754b49d1f8e1a8b98f2bb3d98482a22a71b04084f6dbf
SSDEEP

24576:h1OYdaO0CZ/iWCvu/2sWsJA/jlt+DHhsd:h1OsKCpYO/dJJDHhsd

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

pid process

4460 0YpQ0HQK50VxPYg.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

pid	process
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe
4460	0YpQ0HQK50VxPYg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

0YpQ0HQK50VxPYg.exe

description	pid	process
Token: SeDebugPrivilege	4460	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	4460	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	4460	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	4460	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	4460	0YpQ0HQK50VxPYg.exe
Token: SeDebugPrivilege	4460	0YpQ0HQK50VxPYg.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe

description	pid	process	target process
PID 2532 wrote to memory of 4460	2532	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe
PID 2532 wrote to memory of 4460	2532	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe
PID 2532 wrote to memory of 4460	2532	c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe	0YpQ0HQK50VxPYg.exe

C:\Users\Admin\AppData\Local\Temp\c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe
"C:\Users\Admin\AppData\Local\Temp\c8511af3053376206c852490a127af64738a1c625e7b81e5d2d168a892a51afb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532

C:\Users\Admin\AppData\Local\Temp\7zSF19E.tmp\0YpQ0HQK50VxPYg.exe
.\0YpQ0HQK50VxPYg.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF19E.tmp\0YpQ0HQK50VxPYg.dat
Filesize
1KB

MD5
37cc0b131f1130fa7c301ccaa1a38f45

SHA1
0ab081c3b72b5db3d65442c580a5924333113799

SHA256
ff8b25306eabe58e360723d312e4a88afaefd6aeb7bf965dbbc266371beb4295

SHA512
c06133d5e5dbe4a93c4d1b9ba85493ce6ed9c0985f31af79fb563ddb70449470b767bd7a7ba44d789e8a68753f820fbcdd64837fd080cf3105f7da326b1718c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF19E.tmp\0YpQ0HQK50VxPYg.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF19E.tmp\0YpQ0HQK50VxPYg.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF19E.tmp\mpdonhflclpfmekfpngadjcfpahibeed\background.html
Filesize
142B

MD5
bedf9b0d957793a2961f96ed2cd67c40

SHA1
b4c66dc565db307d251df331293dbc42936d5fa3

SHA256
d9c4960eddad7eaaa3ea0722ea2bfeb8a55024ced128e0f70f79fab2cdff98f9

SHA512
08be4c7b10c93f2a5a2c0c645b9dff285af233ab3b9332efbd5e0a8ce2f97246b1ac066b94a2e006908df0c8adb3f6ed6d84b529c7bdec37e945de666ac02ea4

Download Submit
memory/4460-132-0x0000000000000000-mapping.dmp

Download