7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109

Analysis

max time kernel
84s
max time network
88s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe
Size

639KB
MD5

b7cd08ef1e02cb4c47dd84d7eefded14
SHA1

72c61924af666b93187d5bfa639c794ee111b8c9
SHA256

7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109
SHA512

6b17c3236ac69b9191f133996fc5a24252161b2a657f139adef28f70c4743a4b1da44b9105c1f4a58ef4fd77ea56939db8313afb051bb35a7d6146b8e8ac0da6
SSDEEP

12288:OgitGs0IsFqner8qaMoGUFOcMxTY0gTurlOGb5O+yHCs57bBQe5A:LitV0IsFKer8RMoRF6qTurlDVO7H/57S

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

~GM9DD6.exe

pid process

1368 ~GM9DD6.exe
Loads dropped DLL 1 IoCs

Processes:

7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe

pid process

2016 7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe

description pid process

Token: SeDebugPrivilege 2016 7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe

pid	process
1368	~GM9DD6.exe

pid	process
2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe

description	pid	process
Token: SeDebugPrivilege	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe

description	pid	process	target process
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe
PID 2016 wrote to memory of 1368	2016	7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe	~GM9DD6.exe

C:\Users\Admin\AppData\Local\Temp\7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe
"C:\Users\Admin\AppData\Local\Temp\7a37f9b76cbdee6fb5c6138061fb8832701d5dada9a1078da4c498b7e2875109.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Local\Temp\~GM9DD6.exe
"C:\Users\Admin\AppData\Local\Temp\~GM9DD6.exe"
2⤵
- Executes dropped EXE
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~GM9DD6.exe
Filesize
332KB

MD5
510860d1cc87a59d583f76910835599b

SHA1
369bf3092710beed05ad75275e19fcb8ffd1f4e8

SHA256
be2e617916c0495a4b0d2f54f10f4a8fd9ec59c6ff17c8f4b19259af123c6c38

SHA512
0e43f69248fd38ab494650265d759b0f7f24734cbbc8a2e0af9e6659b846bcbb546323a2820298f428d7b01e037f6b886432a4b147e2f526337e69aa418111f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\~GM9DD6.exe
Filesize
332KB

MD5
510860d1cc87a59d583f76910835599b

SHA1
369bf3092710beed05ad75275e19fcb8ffd1f4e8

SHA256
be2e617916c0495a4b0d2f54f10f4a8fd9ec59c6ff17c8f4b19259af123c6c38

SHA512
0e43f69248fd38ab494650265d759b0f7f24734cbbc8a2e0af9e6659b846bcbb546323a2820298f428d7b01e037f6b886432a4b147e2f526337e69aa418111f7

Download Submit
\Users\Admin\AppData\Local\Temp\~GM9DD6.exe
Filesize
332KB

MD5
510860d1cc87a59d583f76910835599b

SHA1
369bf3092710beed05ad75275e19fcb8ffd1f4e8

SHA256
be2e617916c0495a4b0d2f54f10f4a8fd9ec59c6ff17c8f4b19259af123c6c38

SHA512
0e43f69248fd38ab494650265d759b0f7f24734cbbc8a2e0af9e6659b846bcbb546323a2820298f428d7b01e037f6b886432a4b147e2f526337e69aa418111f7

Download Submit
memory/1368-56-0x0000000000000000-mapping.dmp

Download
memory/1368-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1368-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1368-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-54-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download