f9a178c79497c66ee786f78ca40984758c41fa779f9eddbebdd69cbb5240b90a

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/01/2023, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 793KB
Sample230102-x1hexafg29
SHA256 f9a178c79497c66ee786f78ca40984758c41fa779f9eddbebdd69cbb5240b90a
MD5 8f20ddfac927369776d27051305cf120
SHA1 498da9ef2955db2380368e76a22d3e63008eadd1
SHA512 2341363905e92e384589adb8c46b3956e7f3b3505f05ffbe41f81d2bbcaf8cff058c656c233b0ab7ede42daedfa2657424e961ee13c898eb0ed0ec05d97158b5
SSDEEP 24576:hLAt3ieGOGoNOcfLtAz2QFPlePWBoyYIj:te/VNLFIAPx7Y
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
2040	waiqbprryyzjyscl.exe
1432	ghoul.exe

Loads dropped DLL 11 IoCs

pid	Process
1724	file.exe
2040	waiqbprryyzjyscl.exe
1724	file.exe
1724	file.exe
1724	file.exe
1724	file.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe
1732	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1092	1724	WerFault.exe	26
1732	1432	WerFault.exe	30

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	file.exe
1028	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	ghoul.exe
Token: SeDebugPrivilege	1028	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2040	1724	file.exe	29
PID 1724 wrote to memory of 2040	1724	file.exe	29
PID 1724 wrote to memory of 2040	1724	file.exe	29
PID 1724 wrote to memory of 2040	1724	file.exe	29
PID 2040 wrote to memory of 1432	2040	waiqbprryyzjyscl.exe	30
PID 2040 wrote to memory of 1432	2040	waiqbprryyzjyscl.exe	30
PID 2040 wrote to memory of 1432	2040	waiqbprryyzjyscl.exe	30
PID 2040 wrote to memory of 1432	2040	waiqbprryyzjyscl.exe	30
PID 1432 wrote to memory of 1028	1432	ghoul.exe	31
PID 1432 wrote to memory of 1028	1432	ghoul.exe	31
PID 1432 wrote to memory of 1028	1432	ghoul.exe	31
PID 1724 wrote to memory of 1092	1724	file.exe	33
PID 1724 wrote to memory of 1092	1724	file.exe	33
PID 1724 wrote to memory of 1092	1724	file.exe	33
PID 1724 wrote to memory of 1092	1724	file.exe	33
PID 1432 wrote to memory of 804	1432	ghoul.exe	34
PID 1432 wrote to memory of 804	1432	ghoul.exe	34
PID 1432 wrote to memory of 804	1432	ghoul.exe	34
PID 804 wrote to memory of 1548	804	cmd.exe	36
PID 804 wrote to memory of 1548	804	cmd.exe	36
PID 804 wrote to memory of 1548	804	cmd.exe	36
PID 1432 wrote to memory of 1732	1432	ghoul.exe	38
PID 1432 wrote to memory of 1732	1432	ghoul.exe	38
PID 1432 wrote to memory of 1732	1432	ghoul.exe	38

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\waiqbprryyzjyscl.exe
  "C:\Users\Admin\AppData\Local\Temp\waiqbprryyzjyscl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\ghoul.exe
    "C:\Users\Admin\AppData\Local\Temp\ghoul.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1028
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PFCIA" /tr "C:\ProgramData\Adobe\PFCIA.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:804
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PFCIA" /tr "C:\ProgramData\Adobe\PFCIA.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1548
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1432 -s 1140
      4⤵
      Loads dropped DLL
      Program crash
      PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 824
  2⤵
  - Program crash
  PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ghoul.exe

Path C:\Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path C:\Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

waiqbprryyzjyscl.exe

Path C:\Users\Admin\AppData\Local\Temp\waiqbprryyzjyscl.exe
Size 1.5MB
SHA256 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567
MD5 4c8d2d06487d07ec350aa5c5d699bb55
SHA1 adc4aa68f5aa4b0ea3f9a2ee82100234caea5b2d
SHA512 37f5dcf4a4e5f02c5dfb0d4c5cb18d4980efe387572fc3a50fa0d53a23c4403d8c17dbf2df9fa5bb647c0eb1f0a24d4c86e19aa2fb73b447c6cd62c6652b6bab
SSDEEP 24576:BjhhhkB/Aw/ApZAZv8743EDweFLBNlYesa49t03jN0AK+HoD5PD:Rhhh6FQcv883EDhp5x4S0AKp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

waiqbprryyzjyscl.exe

Path C:\Users\Admin\AppData\Local\Temp\waiqbprryyzjyscl.exe
Size 1.5MB
SHA256 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567
MD5 4c8d2d06487d07ec350aa5c5d699bb55
SHA1 adc4aa68f5aa4b0ea3f9a2ee82100234caea5b2d
SHA512 37f5dcf4a4e5f02c5dfb0d4c5cb18d4980efe387572fc3a50fa0d53a23c4403d8c17dbf2df9fa5bb647c0eb1f0a24d4c86e19aa2fb73b447c6cd62c6652b6bab
SSDEEP 24576:BjhhhkB/Aw/ApZAZv8743EDweFLBNlYesa49t03jN0AK+HoD5PD:Rhhh6FQcv883EDhp5x4S0AKp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path \Users\Admin\AppData\Local\Temp\freebl3.dll
Size 669KB
SHA256 a5396eba9d0564f4bcbafd5a8c4a4019b4b50a5c70a42aef5491a230d21f2922
MD5 ed6249f72ba742802b2fa3ef20900d18
SHA1 6e50eec3f0b13ff71f86ffc46cf7a1d079381bf3
SHA512 6da4cd5642becef120dbde2d070332d08bf5779bc0ffe66bf3cc51ca13db5619ee0b4f8fe3bc897c1876614a2512b2598f5d1c372764dd18b474081004d87c98
SSDEEP 12288:ggPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UNo:ggPbPp9NNP0BgInfW2WMC4M+hx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghoul.exe

Path \Users\Admin\AppData\Local\Temp\ghoul.exe
Size 899KB
SHA256 5f1c900332c6ce00349719a6eccd13894fc312f2b6460d7f419ca49172c8623a
MD5 813862d29c21094ebd1f95feb80771ff
SHA1 5e61691a9d791e798e19d99a27c9f9959d319e9b
SHA512 97fc207a77d4d11103817998177d656e520b889d7b79c9dd1ab4fd66cf1004a9060f2d6e4acf239a7b8016ffd60949a36e4e78ae26f990768a2952275e5b4580
SSDEEP 12288:/zrc0xn4n7KTjcDDWcSXsuCC9FrHVVvPZFcmn6NJU+tzMBC1qf02Zxl:/zrt4nxavcuCsvPl6Na+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \Users\Admin\AppData\Local\Temp\mozglue.dll
Size 627KB
SHA256 bcbf8c8ba4386b7716d5481ef9d089b9448990736d3eebdcfa611a09045c3ec3
MD5 5d59e053d45049ffb8c6c08d8944e30c
SHA1 292f748d5e326143c3233e9d290087337700d606
SHA512 0f8b1c9c30d7b71fb7560377e5895c7bd15d71928c34465b1dde31ae770b6d38d5bac4d34ef4add9e08b72f2b9ea53958f167b0690fa0731af205528512a987b
SSDEEP 12288:G1AVJGFeaY9FS6ogHKMImgqt6r7BYQDishI9bBiE2ARnrYprL:xVJqe19FSpgHKtAQBYQ2TiE2ARn6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \Users\Admin\AppData\Local\Temp\nss3.dll
Size 2.0MB
SHA256 0bce97e8f6cc435250fb6aea0441e4146c7c8f8d90a9b1e76dfabd8701bfd882
MD5 05ed4ffbf6b785750d2cdacca9287f10
SHA1 579c656536ce9cd076fc790cf443caf3a8db5b8f
SHA512 dddabf3ab629ec5b15e879f90d5f9bb69d6a8b47222989d3e683cbc8a6d4072740a5c5db05952d236529dfdde645990d21a4a9b32c4419ace9e2fe409fce4f01
SSDEEP 49152:fHhQX/2LasA4/BHeCvst/tVJZn8V0c0qRy:fHhQv2TB+4sPJF8V0c0Uy
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path \Users\Admin\AppData\Local\Temp\softokn3.dll
Size 251KB
SHA256 c10801dba6c50237dba700fe2be920f091792e45c32e00db7c63c2c19a35f3a5
MD5 3a59b504f6c41324b0d6cb6edbe3ad61
SHA1 2b3aff110badd913d221605d2f01638473dc5756
SHA512 56c9b7d4afcf8666aedaf55f819b799f2d84bc0736e0c431973114ae760da57209041785b7894f8b6d8d3e70bf040db68f7a95fcbb419fb6c44b70266eecc02d
SSDEEP 6144:gkFiy/LuRT3AuP2mzXP0vKlcKsvzg1mJr5fr3cM16+0/bQaz5jckXinisYz+xnPX:gkMy/LuRTwuPFXPAKlak1CzcMVHxYz+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

waiqbprryyzjyscl.exe

Path \Users\Admin\AppData\Local\Temp\waiqbprryyzjyscl.exe
Size 1.5MB
SHA256 5fe74ecfd6a9eeef45bed3760e4511c300dc843d17120361e5abd021cc107567
MD5 4c8d2d06487d07ec350aa5c5d699bb55
SHA1 adc4aa68f5aa4b0ea3f9a2ee82100234caea5b2d
SHA512 37f5dcf4a4e5f02c5dfb0d4c5cb18d4980efe387572fc3a50fa0d53a23c4403d8c17dbf2df9fa5bb647c0eb1f0a24d4c86e19aa2fb73b447c6cd62c6652b6bab
SSDEEP 24576:BjhhhkB/Aw/ApZAZv8743EDweFLBNlYesa49t03jN0AK+HoD5PD:Rhhh6FQcv883EDhp5x4S0AKp9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-69-0x000007FEED210000-0x000007FEEDC33000-memory.dmp

Download

memory/1028-86-0x000007FEEC6B0000-0x000007FEED20D000-memory.dmp

Download

memory/1028-98-0x000000000277B000-0x000000000279A000-memory.dmp

Download

memory/1028-68-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Download

memory/1028-97-0x0000000002774000-0x0000000002777000-memory.dmp

Download

memory/1028-87-0x0000000002774000-0x0000000002777000-memory.dmp

Download

memory/1028-92-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Download

memory/1432-65-0x0000000000E80000-0x0000000000F66000-memory.dmp

Download

memory/1724-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Download

memory/1724-81-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1724-70-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1724-100-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2040-66-0x0000000004B86000-0x0000000004B97000-memory.dmp

Download

memory/2040-59-0x0000000000030000-0x00000000001BC000-memory.dmp

Download