fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81

General

Target

fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
Size

685KB
MD5

90d83c7d3477803d847ce89613b035d6
SHA1

5eac96da556f831ed687fbcd78549e6c476ffe61
SHA256

fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81
SHA512

7eed2ee49fa2285f78fcae0175c5bea0fad19839713ba94ec6b2adcdb3ab736f69cb1ed6de4936d18a25a9ca3eca77b7bcc469f2ed534389155bd2e9bf14bf06
SSDEEP

12288:rXi1xcZVNe+keYaOeoG7FCibEPVMVWmQYfIjBKEZa+rUlynwMEcR157N59lU98:NdejCOeoQHbEPVMVWmQYgjB115A

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1372	InternetExplorer.exe

Loads dropped DLL 1 IoCs

pid	Process
520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Internet Explorer = "C:\\Windows\\system32\\InternetExplorer.exe"	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.ini	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File created	C:\Windows\SysWOW64\InternetExplorer.exe	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File opened for modification	C:\Windows\SysWOW64\InternetExplorer.exe	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File created	C:\Windows\SysWOW64\explorer_setup.txt	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
File created	C:\Windows\SysWOW64\explorer_log.txt	InternetExplorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1896	520	WerFault.exe	20

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1372	InternetExplorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1372	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	28
PID 520 wrote to memory of 1372	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	28
PID 520 wrote to memory of 1372	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	28
PID 520 wrote to memory of 1372	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	28
PID 520 wrote to memory of 1896	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	29
PID 520 wrote to memory of 1896	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	29
PID 520 wrote to memory of 1896	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	29
PID 520 wrote to memory of 1896	520	fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe	29

C:\Users\Admin\AppData\Local\Temp\fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe
"C:\Users\Admin\AppData\Local\Temp\fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\SysWOW64\InternetExplorer.exe
  "C:\Windows\System32\InternetExplorer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 640
  2⤵
  - Program crash
  PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\InternetExplorer.exe

Filesize
685KB

MD5
90d83c7d3477803d847ce89613b035d6

SHA1
5eac96da556f831ed687fbcd78549e6c476ffe61

SHA256
fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81

SHA512
7eed2ee49fa2285f78fcae0175c5bea0fad19839713ba94ec6b2adcdb3ab736f69cb1ed6de4936d18a25a9ca3eca77b7bcc469f2ed534389155bd2e9bf14bf06

Download Submit
C:\Windows\SysWOW64\explorer.ini

Filesize
54B

MD5
345015190a6467a6d5e1c1f91ffe25d9

SHA1
5d7bdb44a6bc46d3dc5922eefee24880e46b6031

SHA256
fa872975e8a137600775446a8f0cc60876e2e984783fca1f3e4d0e847e838cd9

SHA512
e11e22b63af0ba20d9abd5d72d24ff70cba86229b9221f785df4a1b4b311c9b505a63a01f395403be94a2a70c4792efee8c50b674fa301804cd6272bd5ed5269

Download Submit
\Windows\SysWOW64\InternetExplorer.exe

Filesize
685KB

MD5
90d83c7d3477803d847ce89613b035d6

SHA1
5eac96da556f831ed687fbcd78549e6c476ffe61

SHA256
fbdfee5e766033327b05f575c3cf456fa4f71ec39b1bd5ddbfd0dcc69a73bd81

SHA512
7eed2ee49fa2285f78fcae0175c5bea0fad19839713ba94ec6b2adcdb3ab736f69cb1ed6de4936d18a25a9ca3eca77b7bcc469f2ed534389155bd2e9bf14bf06

Download Submit
memory/520-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing