b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc

General

Target

b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe
Size

436KB
MD5

6562d88856681e5e53c073f394e86da9
SHA1

d8b286bc2cbd0533e8a3f949d89fe51dc59237fe
SHA256

b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc
SHA512

f5eb75a02e7f2ae7cb044852f883c118b6af65ab09734ca2a97ef2ad275c659c03110d362ec33c0c774e7b695fb2a372050ce85bd4ca9f8ce9bfd1162e96d7f7
SSDEEP

12288:anc1wV3MIRTBOUg+LFYWSfWknbX22HZxDjpW2tS49:a2k3pR08LF4Fnbh5xrS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3024	0a131764.exe
4696	be45b969.exe
4496	93bc20e1.exe
1124	93bc20e1.exe
4928	93bc20e1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4496-149-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/1124-153-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/4928-159-0x0000000000400000-0x000000000044D000-memory.dmp	upx
behavioral2/memory/1124-158-0x0000000000400000-0x000000000044D000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	93bc20e1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	be45b969.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4696	be45b969.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 3024	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	81
PID 2148 wrote to memory of 3024	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	81
PID 2148 wrote to memory of 3024	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	81
PID 2148 wrote to memory of 4696	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	82
PID 2148 wrote to memory of 4696	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	82
PID 2148 wrote to memory of 4696	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	82
PID 2148 wrote to memory of 4496	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	83
PID 2148 wrote to memory of 4496	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	83
PID 2148 wrote to memory of 4496	2148	b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe	83
PID 4496 wrote to memory of 1124	4496	93bc20e1.exe	84
PID 4496 wrote to memory of 1124	4496	93bc20e1.exe	84
PID 4496 wrote to memory of 1124	4496	93bc20e1.exe	84
PID 4496 wrote to memory of 4928	4496	93bc20e1.exe	86
PID 4496 wrote to memory of 4928	4496	93bc20e1.exe	86
PID 4496 wrote to memory of 4928	4496	93bc20e1.exe	86

C:\Users\Admin\AppData\Local\Temp\b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe
"C:\Users\Admin\AppData\Local\Temp\b01288d58620702beae542e6ff9ab79777e9eb03b7b6780821ad1c765cb333fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\0a131764.exe
  C:\Users\Admin\AppData\Local\Temp\0a131764.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\be45b969.exe
  C:\Users\Admin\AppData\Local\Temp\be45b969.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe
  C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe
    C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
    3⤵
    - Executes dropped EXE
    PID:1124
- - C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe
    C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
    3⤵
    - Executes dropped EXE
    PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0a131764.exe

Filesize
19KB

MD5
42a1116725b4302ffbee833e075e456b

SHA1
1244c20e427ff25c5efd8906d0b23f45b6208a3c

SHA256
fc7b8edf44e4dd5d9010e1c5e8e1838eb6d78c4f71124ca53a6e57b2038a9387

SHA512
3b79bd486a9379aad23e689a72c4ef44e6a2f1f45f23b8d644f2b9e421a0e152805928492bc649a8b478921301996ed65b87c317149fc5ae51b6eda3672ede01

Download Submit
C:\Users\Admin\AppData\Local\Temp\0a131764.exe

Filesize
19KB

MD5
42a1116725b4302ffbee833e075e456b

SHA1
1244c20e427ff25c5efd8906d0b23f45b6208a3c

SHA256
fc7b8edf44e4dd5d9010e1c5e8e1838eb6d78c4f71124ca53a6e57b2038a9387

SHA512
3b79bd486a9379aad23e689a72c4ef44e6a2f1f45f23b8d644f2b9e421a0e152805928492bc649a8b478921301996ed65b87c317149fc5ae51b6eda3672ede01

Download Submit
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe

Filesize
188KB

MD5
a5384d4dd46646f9240a6d9cbabd499e

SHA1
4848cadc52ae8b9268c607dcfc2a8c4395190eda

SHA256
c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1

SHA512
4103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe

Filesize
188KB

MD5
a5384d4dd46646f9240a6d9cbabd499e

SHA1
4848cadc52ae8b9268c607dcfc2a8c4395190eda

SHA256
c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1

SHA512
4103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe

Filesize
188KB

MD5
a5384d4dd46646f9240a6d9cbabd499e

SHA1
4848cadc52ae8b9268c607dcfc2a8c4395190eda

SHA256
c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1

SHA512
4103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\93bc20e1.exe

Filesize
188KB

MD5
a5384d4dd46646f9240a6d9cbabd499e

SHA1
4848cadc52ae8b9268c607dcfc2a8c4395190eda

SHA256
c88e93fde1c75bf00eed15bba12eba227908b768b902af150212a9723826e9c1

SHA512
4103996e5743d90e68df6aa919f172d22ed2df5de5533eb1195ee3cf1cb409378c0c8152703210b730f67f28a9df0f06eb2b2c2d0106dab22ae2660f6254d74b

Download Submit
C:\Users\Admin\AppData\Local\Temp\be45b969.exe

Filesize
204KB

MD5
7bc8cbaeb146937037048e0d80abadd1

SHA1
99bfddc34d8583f20d39f5a3a52b527cfd852972

SHA256
3aa82b190a5ab6cb6269b6a6d8474e54ba3ad28d6b03e3e65303a1828366cd6a

SHA512
5597056e21545390a458c303849ba98fa36714fdd64ec781184f981d2654657ce0a7f12b502ab6290d0bbc3e2baf7f313f836f366185f0a47342c5dd1366cbcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\be45b969.exe

Filesize
204KB

MD5
7bc8cbaeb146937037048e0d80abadd1

SHA1
99bfddc34d8583f20d39f5a3a52b527cfd852972

SHA256
3aa82b190a5ab6cb6269b6a6d8474e54ba3ad28d6b03e3e65303a1828366cd6a

SHA512
5597056e21545390a458c303849ba98fa36714fdd64ec781184f981d2654657ce0a7f12b502ab6290d0bbc3e2baf7f313f836f366185f0a47342c5dd1366cbcb

Download Submit
memory/1124-153-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1124-158-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1124-160-0x0000000000492000-0x00000000004B0000-memory.dmp

Filesize
120KB

Download
memory/1124-154-0x0000000000492000-0x00000000004B0000-memory.dmp

Filesize
120KB

Download
memory/2148-142-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2148-141-0x00000000021D0000-0x0000000002247000-memory.dmp

Filesize
476KB

Download
memory/3024-151-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3024-143-0x0000000000450000-0x000000000045F000-memory.dmp

Filesize
60KB

Download
memory/3024-144-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4496-150-0x000000000060E000-0x000000000062C000-memory.dmp

Filesize
120KB

Download
memory/4496-149-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4496-155-0x000000000060E000-0x000000000062C000-memory.dmp

Filesize
120KB

Download
memory/4696-152-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4696-148-0x0000000000610000-0x000000000065B000-memory.dmp

Filesize
300KB

Download
memory/4696-147-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4928-161-0x0000000000533000-0x0000000000551000-memory.dmp

Filesize
120KB

Download
memory/4928-159-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing