c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

General

Target

c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe
Size

296KB
MD5

fef18010402c5347fe8c7a5a98f0982b
SHA1

ef82499b601e75d0ec7d737d8fa2858c1d705bb3
SHA256

c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f
SHA512

7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624
SSDEEP

6144:WhLJznPSO7mq+vtWEmtGDCv/4uLwGGLTW3yyEPy:WXaOomtGDCloLi9EPy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
700	uninstall.exe

Loads dropped DLL 4 IoCs

pid	Process
1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe
700	uninstall.exe
700	uninstall.exe
700	uninstall.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
700	uninstall.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe
700	uninstall.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28
PID 1252 wrote to memory of 700	1252	c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe	28

C:\Users\Admin\AppData\Local\Temp\c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe
"C:\Users\Admin\AppData\Local\Temp\c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\uninstall.exe
  "C:\Users\Admin\AppData\Local\Temp\uninstall.exe" /remove
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
296KB

MD5
fef18010402c5347fe8c7a5a98f0982b

SHA1
ef82499b601e75d0ec7d737d8fa2858c1d705bb3

SHA256
c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

SHA512
7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624

Download Submit
C:\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
296KB

MD5
fef18010402c5347fe8c7a5a98f0982b

SHA1
ef82499b601e75d0ec7d737d8fa2858c1d705bb3

SHA256
c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

SHA512
7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624

Download Submit
\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
296KB

MD5
fef18010402c5347fe8c7a5a98f0982b

SHA1
ef82499b601e75d0ec7d737d8fa2858c1d705bb3

SHA256
c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

SHA512
7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624

Download Submit
\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
296KB

MD5
fef18010402c5347fe8c7a5a98f0982b

SHA1
ef82499b601e75d0ec7d737d8fa2858c1d705bb3

SHA256
c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

SHA512
7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624

Download Submit
\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
296KB

MD5
fef18010402c5347fe8c7a5a98f0982b

SHA1
ef82499b601e75d0ec7d737d8fa2858c1d705bb3

SHA256
c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

SHA512
7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624

Download Submit
\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
296KB

MD5
fef18010402c5347fe8c7a5a98f0982b

SHA1
ef82499b601e75d0ec7d737d8fa2858c1d705bb3

SHA256
c5e0bf941c0104db500986939162d9c5e4e4cae21fe2e7cc78b2a8164a01889f

SHA512
7fb63b4d52fbdd534125dae441a11226b7f318560a72c183cd5f12fea7f89d5c5018fed6b50dc319b6f9d75415ffbb0c3edecf7ee917469a84ccc269ae08c624

Download Submit
memory/1252-54-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing