7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0

General

Target

7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Size

238KB
MD5

11e46138edb94bb4a5401619b636b940
SHA1

e8e5ac4b97005b4b2d892d761bef34b6de50e886
SHA256

7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0
SHA512

210b100240811e48221ddbd9a2b1e702bd2f583027ea2e103ca4c8d8946746093b3f60f4bc9c0bb6f54d152b90796379d1bfaf983ae0679a1492d3681c0bb14e
SSDEEP

6144:QDzwcnj67t6zAqtaZWsBpqALSQhUg89PPk+yi2wyyQRI9ULT4t4xhfJoKuCkJ0:Qz6x0AqEZ51Vx8VPf9CSvt

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\F:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\M:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\S:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\V:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\G:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\H:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\K:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\N:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\Q:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\W:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\X:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\O:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\R:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\I:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\J:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\L:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\P:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\T:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened (read-only)	\??\U:	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.ivr	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard\Extension = ".vcf"	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wab	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\Content Type = "text/x-vcard"	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\" /vcard %1"	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\DefaultIcon\ = "\"C:\\Program Files (x86)\\Windows Mail\\wab.exe\",1"	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\text/x-vcard	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vcf\ = "vcard_wab_auto_file"	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\ = "vCard File"	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vcard_wab_auto_file\shell\open\command	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4868	7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe

C:\Users\Admin\AppData\Local\Temp\7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe
"C:\Users\Admin\AppData\Local\Temp\7bded34665fb26f0add2b16eb61cd3fb4424f57e83bb1ed6094b8bcdb9e750b0.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-132-0x0000000001000000-0x000000000105B000-memory.dmp

Filesize
364KB

Download
memory/4868-133-0x0000000000B30000-0x0000000000B57000-memory.dmp

Filesize
156KB

Download
memory/4868-134-0x0000000000B31000-0x0000000000B4E000-memory.dmp

Filesize
116KB

Download
memory/4868-135-0x0000000001000000-0x000000000105B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing