ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8

Analysis

max time kernel
79s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe
Size

220KB
MD5

da6c73ba77ee86b9adeb6636e96a8632
SHA1

d9d77e87497ec970e759849385391b5dde418c0b
SHA256

ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8
SHA512

6ad4a37adbd4698a4fca42f96e7ef5d0588d4c077f9b1309f336f11c274397b4f6581e5b648c622a8cc849576ece2efbd53fb6c7854a0028c9bb8a27ce49a356
SSDEEP

3072:f1D6LeSl5Htc5ckACyJiMAx9yZw4tVD29TJEhA:9gewNiSJiMAx0WT

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
520	0jpz.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 520	1236	ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe	29
PID 1236 wrote to memory of 520	1236	ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe	29
PID 1236 wrote to memory of 520	1236	ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe	29
PID 1236 wrote to memory of 520	1236	ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe	29

C:\Users\Admin\AppData\Local\Temp\ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe
"C:\Users\Admin\AppData\Local\Temp\ea6870d72286625f70a602caffacfa72843e2e304c09542040baaac78f1929e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- \??\c:\0jpz.exe
  c:\0jpz.exe
  2⤵
  - Executes dropped EXE
  PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\0jpz.exe

Filesize
20KB

MD5
2f88fe6fe9776bb95ae2ced8beb5db3d

SHA1
94dee8b3b67ad4bf0d676914a29e0cc5aff43b26

SHA256
ce408768705c6382437b0d97cbe1e6aadfcc86c76a8e581ac2c57c82b89690a7

SHA512
d5b589bb8041d9af836c8430f716905710fc3c1e94eddd1777db9924ddf678fadea8ab8ef8cb8ade25d5526914e9c975e9898d388b35ec8041c912b8184574c4

Download Submit
memory/520-57-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1236-54-0x000007FEF4070000-0x000007FEF4A93000-memory.dmp

Filesize
10.1MB

Download