25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4

General

Target

25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe
Size

596KB
MD5

d1ab0f2e1d947093d162b10bd91f716c
SHA1

aa4b17ad4fd5925e381e8b3336570afe43a3e2d9
SHA256

25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4
SHA512

752d6ea07ce45908e8ebcf5e22a2d34b87c2012342c3adad100d192bfa63dd67338bf7973b4360af96c552efde3f938afb9b027c5b5786b8115735d53dab5b32
SSDEEP

12288:HPV/O9w18gJ6LaE4apr7eYKzO+glZulo10q+qJ9T3+m2ffvubzFzhQwlhJxui:4C1eLcax7eYeO3rl0qHpW2ZBhj

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Microsoft.exe"	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2988	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe
2988	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30
PID 3012 wrote to memory of 2988	3012	25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe
"C:\Users\Admin\AppData\Local\Temp\25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\25de0c1d22cd9175d2770082b96d7c12a39af93732293d4b164b2e3865a3a9e4_JC.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-70-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2988-68-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2988-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2988-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2988-65-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2988-79-0x0000000000210000-0x0000000000250000-memory.dmp

Filesize
256KB

Download
memory/2988-78-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-75-0x0000000000210000-0x0000000000250000-memory.dmp

Filesize
256KB

Download
memory/2988-62-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2988-63-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2988-74-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2988-73-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3012-60-0x00000000008B0000-0x00000000008BE000-memory.dmp

Filesize
56KB

Download
memory/3012-57-0x00000000006F0000-0x0000000000700000-memory.dmp

Filesize
64KB

Download
memory/3012-71-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-54-0x0000000000810000-0x00000000008AA000-memory.dmp

Filesize
616KB

Download
memory/3012-58-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-56-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download
memory/3012-61-0x00000000056B0000-0x000000000572C000-memory.dmp

Filesize
496KB

Download
memory/3012-55-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/3012-59-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads