6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115

General

Target

6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
Size

6.0MB
MD5

66bc243148fda03460497984ca205dfc
SHA1

e330b377beb736a07b53fdf93ccf7e5a02a66ef8
SHA256

6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115
SHA512

f5198a7a24e53479e446c962a33f28cde86767bb4dbc0b748bf42fdb781eb6779b9ad035dbfe836d1e234c57ec6a229ae604f50e3d59b3fe7cad1a87642e7807
SSDEEP

98304:8ZgVC808wNF1L+x1BmOQg+u+p6ezDuaW7outhGf+fSxYEv+xcTESsfeC:82VCj8wNvCIBv62DuD7thGQPSdC

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crsysys.exe	NewFolder.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crsysys.exe	NewFolder.exe

Executes dropped EXE 1 IoCs

pid	Process
2008	NewFolder.exe

Loads dropped DLL 4 IoCs

pid	Process
780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Zip	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
File created	C:\Program Files (x86)\Zip\__tmp_rar_sfx_access_check_7080510	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
File created	C:\Program Files (x86)\Zip\NewFolder.exe	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
File opened for modification	C:\Program Files (x86)\Zip\NewFolder.exe	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	NewFolder.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 2008	780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe	27
PID 780 wrote to memory of 2008	780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe	27
PID 780 wrote to memory of 2008	780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe	27
PID 780 wrote to memory of 2008	780	6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe	27

C:\Users\Admin\AppData\Local\Temp\6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe
"C:\Users\Admin\AppData\Local\Temp\6cf9679ec9d42b365c344891e973ef604e104f66eb1fe722f2a8ad39afedd115.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files (x86)\Zip\NewFolder.exe
  "C:\Program Files (x86)\Zip\NewFolder.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Zip\NewFolder.exe

Filesize
750.0MB

MD5
bd84dd4f8ff29b57c39ced14bae88e31

SHA1
ac0cd9424421cb37a53866c35aa86828d3699c06

SHA256
65ac5a3aa6cbd905fcb3de8136d2f80144bf3ac73a3fd66b037dd3d4c40f0cf4

SHA512
d537dd1a0d112e18aac739a33018ef3abc3927a7c8147995dd4e9bd3e5d373673ef1b329e1925f3e8bb5d3c821afa0d5c0c263cb0f6e31b24a30952663af18a7

Download Submit
\??\c:\Program Files (x86)\Zip\NewFolder.exe

Filesize
750.0MB

MD5
bd84dd4f8ff29b57c39ced14bae88e31

SHA1
ac0cd9424421cb37a53866c35aa86828d3699c06

SHA256
65ac5a3aa6cbd905fcb3de8136d2f80144bf3ac73a3fd66b037dd3d4c40f0cf4

SHA512
d537dd1a0d112e18aac739a33018ef3abc3927a7c8147995dd4e9bd3e5d373673ef1b329e1925f3e8bb5d3c821afa0d5c0c263cb0f6e31b24a30952663af18a7

Download Submit
\Program Files (x86)\Zip\NewFolder.exe

Filesize
750.0MB

MD5
bd84dd4f8ff29b57c39ced14bae88e31

SHA1
ac0cd9424421cb37a53866c35aa86828d3699c06

SHA256
65ac5a3aa6cbd905fcb3de8136d2f80144bf3ac73a3fd66b037dd3d4c40f0cf4

SHA512
d537dd1a0d112e18aac739a33018ef3abc3927a7c8147995dd4e9bd3e5d373673ef1b329e1925f3e8bb5d3c821afa0d5c0c263cb0f6e31b24a30952663af18a7

Download Submit
\Program Files (x86)\Zip\NewFolder.exe

Filesize
750.0MB

MD5
bd84dd4f8ff29b57c39ced14bae88e31

SHA1
ac0cd9424421cb37a53866c35aa86828d3699c06

SHA256
65ac5a3aa6cbd905fcb3de8136d2f80144bf3ac73a3fd66b037dd3d4c40f0cf4

SHA512
d537dd1a0d112e18aac739a33018ef3abc3927a7c8147995dd4e9bd3e5d373673ef1b329e1925f3e8bb5d3c821afa0d5c0c263cb0f6e31b24a30952663af18a7

Download Submit
\Program Files (x86)\Zip\NewFolder.exe

Filesize
750.0MB

MD5
bd84dd4f8ff29b57c39ced14bae88e31

SHA1
ac0cd9424421cb37a53866c35aa86828d3699c06

SHA256
65ac5a3aa6cbd905fcb3de8136d2f80144bf3ac73a3fd66b037dd3d4c40f0cf4

SHA512
d537dd1a0d112e18aac739a33018ef3abc3927a7c8147995dd4e9bd3e5d373673ef1b329e1925f3e8bb5d3c821afa0d5c0c263cb0f6e31b24a30952663af18a7

Download Submit
\Program Files (x86)\Zip\NewFolder.exe

Filesize
750.0MB

MD5
bd84dd4f8ff29b57c39ced14bae88e31

SHA1
ac0cd9424421cb37a53866c35aa86828d3699c06

SHA256
65ac5a3aa6cbd905fcb3de8136d2f80144bf3ac73a3fd66b037dd3d4c40f0cf4

SHA512
d537dd1a0d112e18aac739a33018ef3abc3927a7c8147995dd4e9bd3e5d373673ef1b329e1925f3e8bb5d3c821afa0d5c0c263cb0f6e31b24a30952663af18a7

Download Submit
memory/780-60-0x0000000003650000-0x0000000003AF2000-memory.dmp

Filesize
4.6MB

Download
memory/780-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/780-63-0x0000000003650000-0x0000000003AF2000-memory.dmp

Filesize
4.6MB

Download
memory/2008-67-0x0000000000400000-0x0000000000858000-memory.dmp

Filesize
4.3MB

Download
memory/2008-71-0x0000000009910000-0x000000000996E000-memory.dmp

Filesize
376KB

Download
memory/2008-66-0x0000000000400000-0x00000000008A2000-memory.dmp

Filesize
4.6MB

Download
memory/2008-68-0x0000000005920000-0x0000000005A0C000-memory.dmp

Filesize
944KB

Download
memory/2008-69-0x00000000098C0000-0x0000000009912000-memory.dmp

Filesize
328KB

Download
memory/2008-70-0x0000000005570000-0x000000000558A000-memory.dmp

Filesize
104KB

Download
memory/2008-65-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2008-72-0x0000000005145000-0x0000000005156000-memory.dmp

Filesize
68KB

Download
memory/2008-73-0x0000000010000000-0x000000001013C000-memory.dmp

Filesize
1.2MB

Download
memory/2008-76-0x0000000006890000-0x00000000068B0000-memory.dmp

Filesize
128KB

Download
memory/2008-77-0x0000000005145000-0x0000000005156000-memory.dmp

Filesize
68KB

Download
memory/2008-78-0x0000000010000000-0x000000001013C000-memory.dmp

Filesize
1.2MB

Download
memory/2008-79-0x0000000010000000-0x000000001013C000-memory.dmp

Filesize
1.2MB

Download
memory/2008-80-0x0000000005145000-0x0000000005156000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing