d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9

General

Target

d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
Size

361KB
MD5

33c9a90e00b9aaf7e2786410a6e92288
SHA1

24505621e144d7186e22f3295bf0c40158027037
SHA256

d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9
SHA512

72a029923ddec5a57bb49a4b239bb417fe9d66caaa6f7c80659122741454b01466a46a4edda31ad9185113cf2214c920f589f0657e14f2c3ec708f2359dd1c5c
SSDEEP

1536:5ldTg3KN9+rxmCWP+9URpKxQxk2Y0792HXfo0zW4nfeff6Wr:jdUaN9+rxh9cpKxQxk2Y0792HXfrf7k

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe

Deletes itself 1 IoCs

pid	Process
2044	cmd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	whatismyip.akamai.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2044	1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe	30
PID 1096 wrote to memory of 2044	1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe	30
PID 1096 wrote to memory of 2044	1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe	30
PID 1096 wrote to memory of 2044	1096	d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe	30

C:\Users\Admin\AppData\Local\Temp\d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe
"C:\Users\Admin\AppData\Local\Temp\d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\d1d0c407e435bb4ad062d1e054e4704b0b0fa9134675a293e07b05b38884c3a9.exe" >> NUL
  2⤵
  - Deletes itself
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1096-55-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1096-56-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1096-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads