0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068

Analysis

max time kernel
50s
max time network
64s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
14-04-2023 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068.exe
Size

4.3MB
MD5

acd113200491b844d0eb2272d454d3c7
SHA1

8a1707df13881d1e042a9493d9225b9514886d80
SHA256

0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068
SHA512

805728786415072400e37567709710f26e8cf0e848972aed2a7c275a2f3fdd03c58272b1b991711e30163112fef5c2239ceb2028ff5379269c642048eed4f878
SSDEEP

98304:5aL2B6Tc+QGQag6dY4xj5OYDCQlxz8poI3VL6pvXM+E:cCgTc+DQagh8QLQnzmoI3t6h/E

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2484-121-0x0000000000B70000-0x00000000019D4000-memory.dmp	upx
behavioral1/memory/2484-122-0x0000000000B70000-0x00000000019D4000-memory.dmp	upx
behavioral1/memory/2484-123-0x0000000000B70000-0x00000000019D4000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2684	2484	0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068.exe	66
PID 2484 wrote to memory of 2684	2484	0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068.exe	66
PID 2684 wrote to memory of 3012	2684	cmd.exe	68
PID 2684 wrote to memory of 3012	2684	cmd.exe	68

C:\Users\Admin\AppData\Local\Temp\0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068.exe
"C:\Users\Admin\AppData\Local\Temp\0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\0ff8d88d307f908a1d234b690e52e49f11c2ba96c18f007fe8e065709e160068.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 0
    3⤵
    PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-121-0x0000000000B70000-0x00000000019D4000-memory.dmp

Filesize
14.4MB

Download
memory/2484-122-0x0000000000B70000-0x00000000019D4000-memory.dmp

Filesize
14.4MB

Download
memory/2484-123-0x0000000000B70000-0x00000000019D4000-memory.dmp

Filesize
14.4MB

Download