77b06750d70242fa640de1f435856192c73f09996d4bc944809ea5966ae299ba

General

Target

e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
Size

620KB
MD5

159d5fc953b4f50ba36c98edd6fd6c81
SHA1

ee0a0d42ea26dab26f9e71483f5e6537e74934a6
SHA256

e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3
SHA512

10a54fa8bbedb0136d7e8748c93b121ea5a8dc1dbf1fbc4e6d5a76c5637c59b9853b6144ee79fe4454b430eeb4fef52a8d73a590db14533ae8bf3c2f6fabb952
SSDEEP

12288:v0Dl+C42xjWYXEsWYGzxfk+PdnBGFaSj29jwX9np3BkA+5CTXgJT1HLE+tki:gTXwY6xH1nu+wXrBkA+5eQJTVLE+t

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
2044	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
2044	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
3060	powershell.exe
2276	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
Token: SeDebugPrivilege	2044	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3060	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	30
PID 1180 wrote to memory of 3060	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	30
PID 1180 wrote to memory of 3060	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	30
PID 1180 wrote to memory of 3060	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	30
PID 1180 wrote to memory of 2276	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	32
PID 1180 wrote to memory of 2276	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	32
PID 1180 wrote to memory of 2276	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	32
PID 1180 wrote to memory of 2276	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	32
PID 1180 wrote to memory of 1788	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	33
PID 1180 wrote to memory of 1788	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	33
PID 1180 wrote to memory of 1788	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	33
PID 1180 wrote to memory of 1788	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	33
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36
PID 1180 wrote to memory of 2044	1180	e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe	36

C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
"C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\olHNjIyLhh.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\olHNjIyLhh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
  "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E7.tmp

Filesize
1KB

MD5
7678e2ab22d192ab5638f017c03e47bc

SHA1
5eb652c73ebec3c8658904f7f07f1ac8bcd0f011

SHA256
3eea6b85bf6719c63d90b01346692915bfbf69a8fb91cb77e9656c1b8d31a027

SHA512
9cda5dd9f9ff1efc8f0ca0af1e9409465d18455fb44e6d6fb4a45d21fd5775f8eb38d3e4992d6c32afd5a83a53caa4dfea10d006ca253568baa5820e9c8faf3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
624d0f6ecd035a968f201fdef0ae1d41

SHA1
3e222039618b43a1c7e21cb47d54808773e5b9ec

SHA256
f5ef562294700481705dcb487d3c609e7e25baf9e5c5f3947efb4381737500b7

SHA512
0a2c63604f108ee18bba4c6517476a9d8b5bbb13b3e125c5adff5f783725989aa801aadba265cfa36a350281f97ffbc05f978a3848903d5f07eb7995df51fa80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
624d0f6ecd035a968f201fdef0ae1d41

SHA1
3e222039618b43a1c7e21cb47d54808773e5b9ec

SHA256
f5ef562294700481705dcb487d3c609e7e25baf9e5c5f3947efb4381737500b7

SHA512
0a2c63604f108ee18bba4c6517476a9d8b5bbb13b3e125c5adff5f783725989aa801aadba265cfa36a350281f97ffbc05f978a3848903d5f07eb7995df51fa80

Download Submit
memory/1180-54-0x0000000000EE0000-0x0000000000F80000-memory.dmp

Filesize
640KB

Download
memory/1180-55-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-56-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/1180-57-0x0000000000A40000-0x0000000000A52000-memory.dmp

Filesize
72KB

Download
memory/1180-58-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-59-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/1180-60-0x0000000000A80000-0x0000000000A8E000-memory.dmp

Filesize
56KB

Download
memory/1180-61-0x0000000005730000-0x00000000057AC000-memory.dmp

Filesize
496KB

Download
memory/1180-88-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-83-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2044-97-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2044-81-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2044-75-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2044-85-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2044-87-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2044-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2044-102-0x0000000074890000-0x0000000074F7E000-memory.dmp

Filesize
6.9MB

Download
memory/2044-98-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2044-77-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-93-0x000000006EAF0000-0x000000006F09B000-memory.dmp

Filesize
5.7MB

Download
memory/2276-96-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/2276-91-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/2276-99-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/2276-101-0x000000006EAF0000-0x000000006F09B000-memory.dmp

Filesize
5.7MB

Download
memory/2276-89-0x000000006EAF0000-0x000000006F09B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-92-0x0000000001C80000-0x0000000001CC0000-memory.dmp

Filesize
256KB

Download
memory/3060-94-0x000000006EAF0000-0x000000006F09B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-95-0x0000000001C80000-0x0000000001CC0000-memory.dmp

Filesize
256KB

Download
memory/3060-90-0x000000006EAF0000-0x000000006F09B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-100-0x000000006EAF0000-0x000000006F09B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads