85913d4430d1da9a29e295d98d21997c90edf6d3dea08c709c81e5c8302c3e0f

Analysis

max time kernel
59s
max time network
118s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/01/2023, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA(12323).exe
Size 770KB
Sample230125-nzkzzahe5s
SHA256 85913d4430d1da9a29e295d98d21997c90edf6d3dea08c709c81e5c8302c3e0f
MD5 70cbe946ce455bc38c630348cf08fcac
SHA1 289dd1babdd5efe719a7336eb7a14c8eb2669008
SHA512 b7cf4f88f0e9456a2d76463b63ea2931715d67357958e488fae9b5152ae7b9f7e6b4d06fda18cb7e4502d5808bbbc81e06414cc2aecff31bb9b422a3e56d3818
SSDEEP 24576:axEO7Z61GF5nqVGlxiYhSuy1IB74GrORG:YZ6wF5qMI1uBB74GiRG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 576	1636	SOA(12323).exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1636	SOA(12323).exe
1636	SOA(12323).exe
1828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	SOA(12323).exe
Token: SeDebugPrivilege	576	SOA(12323).exe
Token: SeDebugPrivilege	1828	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
576	SOA(12323).exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1828	1636	SOA(12323).exe	27
PID 1636 wrote to memory of 1828	1636	SOA(12323).exe	27
PID 1636 wrote to memory of 1828	1636	SOA(12323).exe	27
PID 1636 wrote to memory of 1828	1636	SOA(12323).exe	27
PID 1636 wrote to memory of 992	1636	SOA(12323).exe	29
PID 1636 wrote to memory of 992	1636	SOA(12323).exe	29
PID 1636 wrote to memory of 992	1636	SOA(12323).exe	29
PID 1636 wrote to memory of 992	1636	SOA(12323).exe	29
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31
PID 1636 wrote to memory of 576	1636	SOA(12323).exe	31

C:\Users\Admin\AppData\Local\Temp\SOA(12323).exe
"C:\Users\Admin\AppData\Local\Temp\SOA(12323).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wDKDgpGdE.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wDKDgpGdE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA0C3.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:992
- C:\Users\Admin\AppData\Local\Temp\SOA(12323).exe
  "C:\Users\Admin\AppData\Local\Temp\SOA(12323).exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpA0C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA0C3.tmp
Size 1KB
SHA256 7538ad3928792662b7869a4d29a58357e98a07c2edeefbf9fee9e9a0933dc20c
MD5 1c0efb499764244b9830d637e7676e9b
SHA1 82defc26b776ef82a9b3c2d4135f25f5c6ec2571
SHA512 f048aacbdae64fbd09bf35081c9d53401d18d20f8ff375d88196648a23448ccb130c3e9913b9ca2b7850ea5d25f80485bdd4dedd6b541a24c8dd8bbf62fd1394
MD5 SHA1 SHA512

Submit Download

memory/576-65-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/576-74-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/576-72-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/576-69-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/576-68-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/576-67-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/576-64-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/1636-58-0x0000000005E00000-0x0000000005E6A000-memory.dmp

Download

memory/1636-63-0x0000000004410000-0x0000000004440000-memory.dmp

Download

memory/1636-54-0x0000000000D40000-0x0000000000E08000-memory.dmp

Download

memory/1636-57-0x00000000004F0000-0x00000000004FA000-memory.dmp

Download

memory/1636-56-0x00000000004C0000-0x00000000004D0000-memory.dmp

Download

memory/1636-55-0x0000000075071000-0x0000000075073000-memory.dmp

Download

memory/1828-76-0x000000006E400000-0x000000006E9AB000-memory.dmp

Download

memory/1828-77-0x000000006E400000-0x000000006E9AB000-memory.dmp

Download