dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca

General

Target

dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
Size

468KB
MD5

eb2eeee7997386c517f7c0f957ace0d9
SHA1

91ec35a77e3e688800154f0161f6afdf48ed9d26
SHA256

dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca
SHA512

acc0d8a9d6f71e116e5e542bb2dd98c952f620aa4f9d65e8fed50b81908ad62464b3e781ab6fffa47da37de6aad21a27d7267af9253b114e350c6a9b8e8e8ce3
SSDEEP

12288:IQ503j+QR0iGqd0AL9yDyT52V8tIr+RwBJvd8LtnNb:h03j+QGiGM7+yT5ltIr+RwvGZh

Score

7^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 952 set thread context of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 1756 wrote to memory of 952	1756	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	28
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29
PID 952 wrote to memory of 1492	952	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	29

C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
"C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
  "C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
    "C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe"
    3⤵
    PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-56-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/952-57-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/952-59-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/952-62-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/952-80-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1492-72-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-70-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-68-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-74-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-75-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-78-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/1492-79-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-67-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1492-81-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing