1d1911dd777bedb77f8617e8165ae5efea4b01ebcc71c2c8e597f6fd4e6135e8

General

Target

664-63-0x0000000000400000-0x0000000000491000-memory.exe
Size

580KB
MD5

04a164dd70036b52c189f38909b97a38
SHA1

a87b1e840a6d8d53fab0c8652a3d3330038a639d
SHA256

1d1911dd777bedb77f8617e8165ae5efea4b01ebcc71c2c8e597f6fd4e6135e8
SHA512

261de1a288ce8a340739768645b5823b427788d2818d070fd85eae30993e2319d64924d87c25490719a7a83a4678194dc41abb3330f09b07452abe509ffe9c30
SSDEEP

12288:N6L9TYP+Hx3rwJ5GUwnjXfS8qplKOEngfA:N6pTY2rwJ0U4jXf6T5o

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe
1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1352 set thread context of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29
PID 1352 wrote to memory of 908	1352	664-63-0x0000000000400000-0x0000000000491000-memory.exe	29

C:\Users\Admin\AppData\Local\Temp\664-63-0x0000000000400000-0x0000000000491000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\664-63-0x0000000000400000-0x0000000000491000-memory.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
  2⤵
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\4246454246424646303030323036443742464246463030303230\SQLite3_StdCall.dll

Filesize
59KB

MD5
d77b227a28a78627c2323cac75948390

SHA1
e228c3951f2a9fd0febfe07390633ab4f35727f4

SHA256
527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82

SHA512
5627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587

Download Submit
C:\Users\Public\424645~1\SQLITE~1.ZIP

Filesize
31KB

MD5
e91150a120a7d0b90c9541ddc35df2da

SHA1
8b218f7653cba01cd73a818de380e5b1018d1d40

SHA256
e96c6c2d75c1af719909fac9cbf1a63441052c0acc5bfff8e53d663dd0d7ee89

SHA512
3a796d7556799dee2bf2c0ee402b5ad39908ee2572f6e3a9dd78229d0f4e9d3f5236d0e1af08b6a0866189e219df03b0ed428a4b5dfb4ebdf585436615e66e28

Download Submit
C:\Users\Public\424645~1\sqlite3.zip

Filesize
295KB

MD5
21765a296b37c1b074bc14316dc9d6cd

SHA1
c99c541d528ad6defe78970e90361d86ad5fa6ae

SHA256
c5a7d1d5f61a535aa511fc9b8119ff5103be48f97f89e123a138453c4aa5fc66

SHA512
5d3392d0f9ee7ed8d9471375ff5333554ca80b7dbe436c2bacb42c1ffe8a5c687835d58ae8425029f83500f43c19268b3315a5c43edb12b707df367e6b86ea0a

Download Submit
\Users\Public\4246454246424646303030323036443742464246463030303230\SQLite3_StdCall.dll

Filesize
59KB

MD5
d77b227a28a78627c2323cac75948390

SHA1
e228c3951f2a9fd0febfe07390633ab4f35727f4

SHA256
527ec201dcd7695bd9830eb82ab35a3986121de9ea156193834aed9d79223b82

SHA512
5627fbc8bbb98f644e21f101a68f0e0b07b87c264d00ea227286bed8ab6dd4ebf5114f03b632604f775ff93666a409a1a179a81ebfc9246956ba8150ff5b0587

Download Submit
\Users\Public\4246454246424646303030323036443742464246463030303230\sqlite3.dll

Filesize
585KB

MD5
5405413fff79b8d9c747aa900f60f082

SHA1
71caf8907ddd9a3a25d71356bd2ce09bd293bd78

SHA256
3e5a28ffde07ac661c26b6ccf94e64c1c90b1f25b3b24c90605aa922b87642eb

SHA512
2f09a30fc4da5166bd665210fefa1d44ce344f0ec6a37f127d677aeb3ca4fc0d09b7c9c1540f57da1e3449b7f588a1c61115395e965fa153d4baa5033266ed66

Download Submit
memory/908-96-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/908-97-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/908-98-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/908-100-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/908-102-0x0000000000090000-0x000000000009E000-memory.dmp

Filesize
56KB

Download
memory/908-111-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/1352-112-0x0000000060900000-0x0000000060989000-memory.dmp

Filesize
548KB

Download

Analysis

Sharing