99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356

General

Target

99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
Size

142KB
MD5

d2455c2b409f2b03c647e4fc7983aa2a
SHA1

5c5e8f663e0afb19057d1c7c277c279b8ccb1f48
SHA256

99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356
SHA512

2b4c5fe09fd581a321622432b2a19771fdea52c64f5317f0e440a18e0296865a23690b04c2c2adac6a945f11dcd3422150f1d647042ed677b9e351245d18af34
SSDEEP

3072:mas/yr+ymzDI+XXfbxKr1pJML6ef8Rt4pSAQOomQUb:masqr+9DIO0nML6eCtmQOomQUb

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1504-56-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1504-57-0x0000000000400000-0x0000000000476000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\EXAVR = "C:\\Users\\Admin\\AppData\\Local\\Temp\\99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe /cs:1 "	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1720	1504	99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe	35

C:\Users\Admin\AppData\Local\Temp\99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe
"C:\Users\Admin\AppData\Local\Temp\99376176428b2996b1bcea1cce91a84ccd026bd74d1e1d0b3aa2adbcdd0aa356.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Security Software Discovery

1

T1063

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000130000-0x0000000000136000-memory.dmp

Filesize
24KB

Download
memory/1504-56-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1504-57-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1720-58-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing