898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c

General

Target

898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe
Size

453KB
MD5

f1ebe5b7f27ebb8c9d3de255ce7d1831
SHA1

68fed3e9f7f6ebdec244e587a99bf0a87f455709
SHA256

898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c
SHA512

da53a37db670b0708a2fdcf08d073be939b8d2978e9e2f21d238ba0de4f7afa1c7c083b9d9d4c38f5a75053e5cb9a00b318ea2d8ce86e1de54cfda1c060023c6
SSDEEP

12288:gXsHVyx69mwvYRbPJBjJMlEz3VxUrH26XtXwLB3:GsHVyx69mwgRbBcmbedgLx

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
772	Facebook_Cracker.exe

Loads dropped DLL 1 IoCs

pid	Process
1000	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1400 wrote to memory of 1000	1400	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	28
PID 1000 wrote to memory of 772	1000	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	29
PID 1000 wrote to memory of 772	1000	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	29
PID 1000 wrote to memory of 772	1000	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	29
PID 1000 wrote to memory of 772	1000	898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe	29

C:\Users\Admin\AppData\Local\Temp\898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe
"C:\Users\Admin\AppData\Local\Temp\898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Users\Admin\AppData\Local\Temp\898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe
  C:\Users\Admin\AppData\Local\Temp\898d0d94982f0155207b4bc02bcaa338814bf958d5c8d475b4ad7cbdf527a91c.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Roaming\Facebook_Cracker.exe
    "C:\Users\Admin\AppData\Roaming\Facebook_Cracker.exe"
    3⤵
    - Executes dropped EXE
    PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Facebook_Cracker.exe

Filesize
27KB

MD5
395419dc57a856b3167f3ce64ac149f5

SHA1
0048a1ddaba90c826be2d43b140177ce9dfb911d

SHA256
8979bc05cad1162411ce0483afbcfc2435dd545b99b175bcb97aa36fe470a1cb

SHA512
c72bb120c2e305e57b8d39c395849c6ae6d93b30041f11984db9216c05ee6e9f72ccced1def9f50039ca2707663b56aa38eaf962cbb7c97867e525aef7296be2

Download Submit
C:\Users\Admin\AppData\Roaming\Facebook_Cracker.exe

Filesize
27KB

MD5
395419dc57a856b3167f3ce64ac149f5

SHA1
0048a1ddaba90c826be2d43b140177ce9dfb911d

SHA256
8979bc05cad1162411ce0483afbcfc2435dd545b99b175bcb97aa36fe470a1cb

SHA512
c72bb120c2e305e57b8d39c395849c6ae6d93b30041f11984db9216c05ee6e9f72ccced1def9f50039ca2707663b56aa38eaf962cbb7c97867e525aef7296be2

Download Submit
\Users\Admin\AppData\Roaming\Facebook_Cracker.exe

Filesize
27KB

MD5
395419dc57a856b3167f3ce64ac149f5

SHA1
0048a1ddaba90c826be2d43b140177ce9dfb911d

SHA256
8979bc05cad1162411ce0483afbcfc2435dd545b99b175bcb97aa36fe470a1cb

SHA512
c72bb120c2e305e57b8d39c395849c6ae6d93b30041f11984db9216c05ee6e9f72ccced1def9f50039ca2707663b56aa38eaf962cbb7c97867e525aef7296be2

Download Submit
memory/772-70-0x0000000000BB6000-0x0000000000BD5000-memory.dmp

Filesize
124KB

Download
memory/772-69-0x0000000000BB6000-0x0000000000BD5000-memory.dmp

Filesize
124KB

Download
memory/772-68-0x000007FEF2600000-0x000007FEF3696000-memory.dmp

Filesize
16.6MB

Download
memory/772-66-0x000007FEF3C80000-0x000007FEF46A3000-memory.dmp

Filesize
10.1MB

Download
memory/1000-60-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1000-67-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1000-61-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1000-56-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1000-59-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing