40756cb5af00d5acb4938d6579432718053a54ecb682145a91bc1ebd94efc002

General

Target

NO. USF23-24072 IGR23110.exe
Size

723KB
MD5

0587a993230426466fc857bb7889e513
SHA1

4787a7076b321400666463a89a5c5233b93c6262
SHA256

e949856ccd8b9d36fb7c2322f2c09d2a969c0121c9b08361cf16dc08c316d3ad
SHA512

78db92623daf346fefabe9280f9016760fba16af2bb8682cdc5feac6361a2f0b216ea4f86dd24e91290d16e504431458afa6382741346678aa63f8799ac1dcc3
SSDEEP

12288:H+uZndSYmJ+37YZaB7G64qY7+4sFlp13yDoh2rj5bhpYOR95R675hmjYJ:H+uNdSYmQ37YZaECYi91CDoM1rYOR9LY

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows\CurrentVersion\Run\wSStSI = "C:\\Users\\Admin\\AppData\\Roaming\\wSStSI\\wSStSI.exe"	NO. USF23-24072 IGR23110.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 2708	3056	NO. USF23-24072 IGR23110.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3056	NO. USF23-24072 IGR23110.exe
3056	NO. USF23-24072 IGR23110.exe
3056	NO. USF23-24072 IGR23110.exe
3056	NO. USF23-24072 IGR23110.exe
2708	NO. USF23-24072 IGR23110.exe
2708	NO. USF23-24072 IGR23110.exe
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	NO. USF23-24072 IGR23110.exe
Token: SeDebugPrivilege	2708	NO. USF23-24072 IGR23110.exe
Token: SeDebugPrivilege	2748	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2748	3056	NO. USF23-24072 IGR23110.exe	30
PID 3056 wrote to memory of 2748	3056	NO. USF23-24072 IGR23110.exe	30
PID 3056 wrote to memory of 2748	3056	NO. USF23-24072 IGR23110.exe	30
PID 3056 wrote to memory of 2748	3056	NO. USF23-24072 IGR23110.exe	30
PID 3056 wrote to memory of 2296	3056	NO. USF23-24072 IGR23110.exe	32
PID 3056 wrote to memory of 2296	3056	NO. USF23-24072 IGR23110.exe	32
PID 3056 wrote to memory of 2296	3056	NO. USF23-24072 IGR23110.exe	32
PID 3056 wrote to memory of 2296	3056	NO. USF23-24072 IGR23110.exe	32
PID 3056 wrote to memory of 2712	3056	NO. USF23-24072 IGR23110.exe	34
PID 3056 wrote to memory of 2712	3056	NO. USF23-24072 IGR23110.exe	34
PID 3056 wrote to memory of 2712	3056	NO. USF23-24072 IGR23110.exe	34
PID 3056 wrote to memory of 2712	3056	NO. USF23-24072 IGR23110.exe	34
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35
PID 3056 wrote to memory of 2708	3056	NO. USF23-24072 IGR23110.exe	35

C:\Users\Admin\AppData\Local\Temp\NO. USF23-24072 IGR23110.exe
"C:\Users\Admin\AppData\Local\Temp\NO. USF23-24072 IGR23110.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rUWSTwkObOa.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rUWSTwkObOa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp619.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\NO. USF23-24072 IGR23110.exe
  "C:\Users\Admin\AppData\Local\Temp\NO. USF23-24072 IGR23110.exe"
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\NO. USF23-24072 IGR23110.exe
  "C:\Users\Admin\AppData\Local\Temp\NO. USF23-24072 IGR23110.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp619.tmp

Filesize
1KB

MD5
c67c2c33abbd18fca37b7d96d4a3b474

SHA1
352574e39131bb0606cec7fdfd685caa3876c257

SHA256
26467f86f6d2c18469f6f70c322e739ea6478fc209532de627e520eeaa69ab91

SHA512
59c20622f1e8320ee306471ffabdc43f6781742980ba30f41650597de7ebc5856a69810c0c9dba6966bd3699d13d660a6b06841c72a6d025dc343490096490b1

Download Submit
memory/2708-86-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2708-70-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-93-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/2708-92-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/2708-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-72-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-85-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/2708-82-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-80-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-69-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-68-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2708-76-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2748-84-0x000000006E490000-0x000000006EA3B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-88-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2748-89-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2748-87-0x000000006E490000-0x000000006EA3B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-90-0x000000006E490000-0x000000006EA3B000-memory.dmp

Filesize
5.7MB

Download
memory/3056-83-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/3056-61-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/3056-60-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/3056-54-0x0000000000890000-0x000000000094A000-memory.dmp

Filesize
744KB

Download
memory/3056-62-0x0000000005830000-0x00000000058AC000-memory.dmp

Filesize
496KB

Download
memory/3056-55-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/3056-56-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/3056-59-0x0000000004CA0000-0x0000000004CE0000-memory.dmp

Filesize
256KB

Download
memory/3056-58-0x0000000074300000-0x00000000749EE000-memory.dmp

Filesize
6.9MB

Download
memory/3056-57-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads