ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6

General

Target

ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe
Size

5.5MB
MD5

1864bad60a4dd284ab7387fb713db447
SHA1

ef9f00670d6fe9dc2a9572c8c0bfb7f54f816d8e
SHA256

ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6
SHA512

32c34bfe5fca0e23d202042f7de3195a8fb90521e638d5b414c823c165d398066f3eb865fbc2657a55b0f8d2f0d2418728730bedb423acd7bc213b8d9a1fefcb
SSDEEP

98304:FyiNIYiwOBpIeWRsTpLhd872XEzeBbbUkVVkfhoPGYD0/r0g:ni1zwRsTpVd877zEbQhocn

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7z.exe

pid process

956 7z.exe

pid	process
956	7z.exe

Loads dropped DLL 3 IoCs

Processes:

ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe7z.exe

pid	process
1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe
1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe
956	7z.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe

pid	process
1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe
1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe

description	pid	process	target process
PID 1692 wrote to memory of 956	1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe	7z.exe
PID 1692 wrote to memory of 956	1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe	7z.exe
PID 1692 wrote to memory of 956	1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe	7z.exe
PID 1692 wrote to memory of 956	1692	ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe	7z.exe

C:\Users\Admin\AppData\Local\Temp\ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe
"C:\Users\Admin\AppData\Local\Temp\ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692

C:\Users\Admin\AppData\Local\Temp\7z.exe
C:\Users\Admin\AppData\Local\Temp\\7z.exe x "C:\Users\Admin\AppData\Local\Temp\ab3e12a6211b890a5bd766723953cb18822c85902a2d81463d1b9f58551c67c6.exe" -y -o"C:\Users\Admin\AppData\Local"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7z.dll
Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe
Filesize
160KB

MD5
a51d90f2f9394f5ea0a3acae3bd2b219

SHA1
20fea1314dbed552d5fedee096e2050369172ee1

SHA256
ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f

SHA512
c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe
Filesize
160KB

MD5
a51d90f2f9394f5ea0a3acae3bd2b219

SHA1
20fea1314dbed552d5fedee096e2050369172ee1

SHA256
ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f

SHA512
c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll
Filesize
893KB

MD5
04ad4b80880b32c94be8d0886482c774

SHA1
344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

SHA256
a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

SHA512
3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe
Filesize
160KB

MD5
a51d90f2f9394f5ea0a3acae3bd2b219

SHA1
20fea1314dbed552d5fedee096e2050369172ee1

SHA256
ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f

SHA512
c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe
Filesize
160KB

MD5
a51d90f2f9394f5ea0a3acae3bd2b219

SHA1
20fea1314dbed552d5fedee096e2050369172ee1

SHA256
ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f

SHA512
c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads