490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732

Analysis

max time kernel
289s
max time network
348s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe
Size

931KB
MD5

bacb0bd7fb1a627e309815db3f24d1ea
SHA1

6181741e39e36b7dd1dde2d515e6413029d9c52b
SHA256

490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732
SHA512

e65293ee22a02662b6111fd6aa5c3661188ce129853ad847882edcef8be71c62249d459c64f4147c6fffb7524c73dfc4629172648e7531e286548a4fc20ed702
SSDEEP

24576:h1OYdaOZCZ/iWCvu/2sWsJA/jlt+DHhs7:h1OsDCpYO/dJJDHhs7

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

OY5ng4aSveaCvQi.exe

pid process

4324 OY5ng4aSveaCvQi.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

OY5ng4aSveaCvQi.exe

pid	process
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe
4324	OY5ng4aSveaCvQi.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

OY5ng4aSveaCvQi.exe

description	pid	process
Token: SeDebugPrivilege	4324	OY5ng4aSveaCvQi.exe
Token: SeDebugPrivilege	4324	OY5ng4aSveaCvQi.exe
Token: SeDebugPrivilege	4324	OY5ng4aSveaCvQi.exe
Token: SeDebugPrivilege	4324	OY5ng4aSveaCvQi.exe
Token: SeDebugPrivilege	4324	OY5ng4aSveaCvQi.exe
Token: SeDebugPrivilege	4324	OY5ng4aSveaCvQi.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe

description	pid	process	target process
PID 4396 wrote to memory of 4324	4396	490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe	OY5ng4aSveaCvQi.exe
PID 4396 wrote to memory of 4324	4396	490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe	OY5ng4aSveaCvQi.exe
PID 4396 wrote to memory of 4324	4396	490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe	OY5ng4aSveaCvQi.exe

C:\Users\Admin\AppData\Local\Temp\490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe
"C:\Users\Admin\AppData\Local\Temp\490b11c8fbb58d158d3d84ad1b4f1a40c5dc135e83a9d09396f09c9b63ebb732.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4396

C:\Users\Admin\AppData\Local\Temp\7zSC4C8.tmp\OY5ng4aSveaCvQi.exe
.\OY5ng4aSveaCvQi.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC4C8.tmp\OY5ng4aSveaCvQi.dat
Filesize
1KB

MD5
0cc0b8a668d7472f3c1ccf73ddffd9fd

SHA1
960027e494a73dc028fa154c3e3d1d35141b21d1

SHA256
a9ec65b7b28fbee42f5f6aa7d6c67e29c04e68a606940618998e623aa34d8f78

SHA512
8818c6e5750436bd069c06c83e34d03d0dbeaf48bde66d61e75149260cd617a3e12fc1a23f4bbfb622b2ff531488be2c1d5605c127e6ce771fd123ba4e997aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4C8.tmp\OY5ng4aSveaCvQi.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC4C8.tmp\OY5ng4aSveaCvQi.exe
Filesize
772KB

MD5
5ed7019dcd0008dbcd8e54017b8c7dd9

SHA1
7e4457da2ff06c2170bad636c9eb7c1bb436fd06

SHA256
7f069fe03db518eee8162ba5f65f98f2afd28137dfde9450d26cd47f6cea8eb7

SHA512
10cef6104aeca8f7a135d4ffffb907b127f055477af4d98228c7385f0da15677357dfed13fc442ee173f85245224fc4b0ae100b832514c80802c5e5a054b70db

Download Submit
memory/4324-132-0x0000000000000000-mapping.dmp

Download