dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
Size

468KB
MD5

eb2eeee7997386c517f7c0f957ace0d9
SHA1

91ec35a77e3e688800154f0161f6afdf48ed9d26
SHA256

dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca
SHA512

acc0d8a9d6f71e116e5e542bb2dd98c952f620aa4f9d65e8fed50b81908ad62464b3e781ab6fffa47da37de6aad21a27d7267af9253b114e350c6a9b8e8e8ce3
SSDEEP

12288:IQ503j+QR0iGqd0AL9yDyT52V8tIr+RwBJvd8LtnNb:h03j+QGiGM7+yT5ltIr+RwvGZh

Score

7^/10

bootkit persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4964 set thread context of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 2820 set thread context of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 4964 wrote to memory of 2820	4964	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	81
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82
PID 2820 wrote to memory of 5092	2820	dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe	82

C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
"C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
  "C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe
    "C:\Users\Admin\AppData\Local\Temp\dbe3b49c7ca21af759b1a3762a2c505006ac43da25596cd66df4ea821c2183ca.exe"
    3⤵
    PID:5092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2820-135-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2820-143-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/5092-140-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5092-142-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5092-144-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download