500340b689a5117c86ce1ef95e8fe23d1e31f3f49854276405d726f8b934ca74

Resubmissions

11/05/2023, 12:18

230511-pgzabadc42 7

22/02/2023, 19:34

230222-x94dqsdb69 7

31/01/2023, 01:08

230131-bhhr3adg43 7

Analysis

max time kernel
1196s
max time network
1191s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/01/2023, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

extracted_at_0x0.exe
Size

2.5MB
MD5

359eedbf4d8e288ecea3de00ff58cb9b
SHA1

4e7a5179fe26c96dec37d9bf9245f8baefea2eb8
SHA256

500340b689a5117c86ce1ef95e8fe23d1e31f3f49854276405d726f8b934ca74
SHA512

324a0a9ffa5f254872abe24abf6bfda3e81e8029c37fcefe319291b6134ace7e24e63ba67cd2e7059e0674f3a547c9059d360052c62b5c655558cc983933082b
SSDEEP

49152:2Dxxed1iUJtSCBFbLHDG/iJkRAQnxPuE5w/fpmjJewtRHNtA5FqVme:2Dxxed1i+zBFbLHC/iiRqE5ufUjJ7RtT

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1740	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1444	powershell.exe
1916	extracted_at_0x0.exe
1916	extracted_at_0x0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1916	extracted_at_0x0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1444	1916	extracted_at_0x0.exe	27
PID 1916 wrote to memory of 1444	1916	extracted_at_0x0.exe	27
PID 1916 wrote to memory of 1444	1916	extracted_at_0x0.exe	27
PID 1916 wrote to memory of 1444	1916	extracted_at_0x0.exe	27
PID 1916 wrote to memory of 1740	1916	extracted_at_0x0.exe	29
PID 1916 wrote to memory of 1740	1916	extracted_at_0x0.exe	29
PID 1916 wrote to memory of 1740	1916	extracted_at_0x0.exe	29
PID 1916 wrote to memory of 1740	1916	extracted_at_0x0.exe	29

C:\Users\Admin\AppData\Local\Temp\extracted_at_0x0.exe
"C:\Users\Admin\AppData\Local\Temp\extracted_at_0x0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension "exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\SysWOW64\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-65-0x0000000073170000-0x000000007371B000-memory.dmp

Filesize
5.7MB

Download
memory/1444-66-0x0000000073170000-0x000000007371B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1916-55-0x0000000000EF0000-0x00000000018F6000-memory.dmp

Filesize
10.0MB

Download
memory/1916-56-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/1916-57-0x0000000010000000-0x0000000010C39000-memory.dmp

Filesize
12.2MB

Download
memory/1916-63-0x0000000000EF0000-0x00000000018F6000-memory.dmp

Filesize
10.0MB

Download