3658606d74992c6003d92dd83e16c097ec89303f216d327d2eb6ee07e1ed00ac

General

Target

03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe
Size

413KB
MD5

b99c76540d3b204c11825ace85c14a3d
SHA1

a128f20a955deb1fb13ec634d13cb8580afd8a3c
SHA256

03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff
SHA512

169260f5e7ab254f5af877340b24124e2dd5f5d71b8d0d91aa298a7768bd1f2a162da73ca582c4dc8880874f7f084aec52badd33e50e3503fb9389fcc7e998ce
SSDEEP

6144:XHRkJHRQjf4tupsZWU+EYUD98oBhhbIiKpWJN:SpRQiuiHpD95bbQpWv

Score

7^/10

spyware

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1156	vbc.exe
1156	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1156	vbc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1520	AcroRd32.exe
1520	AcroRd32.exe
1520	AcroRd32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1156	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	29
PID 1064 wrote to memory of 1520	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	30
PID 1064 wrote to memory of 1520	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	30
PID 1064 wrote to memory of 1520	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	30
PID 1064 wrote to memory of 1520	1064	03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe	30

C:\Users\Admin\AppData\Local\Temp\03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe
"C:\Users\Admin\AppData\Local\Temp\03a94f8ca10dca602d2e2ccb3fe156af60ca783b01bdd95604db8161e66f62ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PDFPDFPDFPDFPDFPDF.pdf"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PDFPDFPDFPDFPDFPDF.pdf

Filesize
41KB

MD5
669fb8542bdc441b1d96771fe8306ff7

SHA1
f90f1fc1b583b0ad8d9a4b0332e53b0f499771dc

SHA256
c8bad4cdad8aa97db1bd311106637a828716e1bca64ccda015fe44d76d07676c

SHA512
275cb59adaf16154c59f4387c307d8fba761bdad53991f2ea753b048a139d7d5e7b1b8517581316ad66fe59e2105ffd5f6ac4cf3f1f6e7a3b4822cd0ccaef9b8

Download Submit
memory/1064-54-0x0000000000D00000-0x0000000000D6E000-memory.dmp

Filesize
440KB

Download
memory/1064-66-0x00000000052B0000-0x00000000052F0000-memory.dmp

Filesize
256KB

Download
memory/1156-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1156-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1156-68-0x00000000049D0000-0x0000000004A10000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing