5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5

Analysis

max time kernel
188s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 00:00

Target

5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe
Size

49KB
MD5

7b516ced86d6ff75406e5fa536ab5556
SHA1

1dcbe5d49c0786c812660fed98f7945afad9b4d4
SHA256

5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5
SHA512

f5682a169fa876463acc69627a9aee47cd9cfdd5f1839a56737949f17d00e49febf72219588320d559ca662c7bf0831a9ecee0dc74b2d28ed2f984ebc58ac616
SSDEEP

768:wTitS/c3p94zMCdMAeYZW2RcprGHA8LZ3tYTLdp+8L0TMYerJBxTXWKF/:wTU6DpWiA8LZ+LMjMB5WK

Score

8^/10

spyware stealer

Executes dropped EXE 1 IoCs

pid	Process
1524	xVKeU.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1524	xVKeU.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	xVKeU.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 1524	32	5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe	83
PID 32 wrote to memory of 1524	32	5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe	83
PID 32 wrote to memory of 1524	32	5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe	83

C:\Users\Admin\AppData\Local\Temp\5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe
"C:\Users\Admin\AppData\Local\Temp\5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:32
- C:\Users\Admin\AppData\Roaming\xVKeU.exe
  C:\Users\Admin\AppData\Roaming\xVKeU.exe C:\Users\Admin\AppData\Local\Temp\5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\xVKeU.exe

Filesize
49KB

MD5
7b516ced86d6ff75406e5fa536ab5556

SHA1
1dcbe5d49c0786c812660fed98f7945afad9b4d4

SHA256
5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5

SHA512
f5682a169fa876463acc69627a9aee47cd9cfdd5f1839a56737949f17d00e49febf72219588320d559ca662c7bf0831a9ecee0dc74b2d28ed2f984ebc58ac616

Download Submit
C:\Users\Admin\AppData\Roaming\xVKeU.exe

Filesize
49KB

MD5
7b516ced86d6ff75406e5fa536ab5556

SHA1
1dcbe5d49c0786c812660fed98f7945afad9b4d4

SHA256
5e09b9501b4f28ed1cff4f5a3b8bf94c157b3d84e3b5fdc602f4db1b9b2125c5

SHA512
f5682a169fa876463acc69627a9aee47cd9cfdd5f1839a56737949f17d00e49febf72219588320d559ca662c7bf0831a9ecee0dc74b2d28ed2f984ebc58ac616

Download Submit
memory/32-132-0x0000000074BD0000-0x0000000075181000-memory.dmp

Filesize
5.7MB

Download
memory/32-137-0x0000000074BD0000-0x0000000075181000-memory.dmp

Filesize
5.7MB

Download
memory/32-139-0x0000000074BD0000-0x0000000075181000-memory.dmp

Filesize
5.7MB

Download
memory/1524-136-0x0000000074BD0000-0x0000000075181000-memory.dmp

Filesize
5.7MB

Download
memory/1524-138-0x0000000074BD0000-0x0000000075181000-memory.dmp

Filesize
5.7MB

Download