Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2023, 19:02

General

  • Target

    e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7.exe

  • Size

    25KB

  • MD5

    f80cfdeb3b16f7aba048db6cbaa2a878

  • SHA1

    241f6d3376a1dca95f1112928ea780c81b31d1dd

  • SHA256

    e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7

  • SHA512

    1ad3687d578649b58a6da1eeb5049a01afd8d92c96f5febe13ae376b8aabaf27a98d656f597ba62b2b9445b9c9fa90603f3c131d486e223aa1e055398a02df28

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvn:8Q3LotOPNSQVwVVxGKEvKHrVn

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7.exe
    "C:\Users\Admin\AppData\Local\Temp\e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    347KB

    MD5

    04e538a2fceaa8fe992cd0f8ed808c40

    SHA1

    653861f93ef6628be7a129aaf9b902c7df55a2ef

    SHA256

    d119e44166bfd95db2d6e6fa1b64f435e67f4b4efa6057b6a41d23f8dbde31f7

    SHA512

    b46907d216d3c275c30e68420cbfce35ba614e927687379693831ee28e1e46ef51d1b05b0cff71864b02d5b481db0b0023e5b8ec2b151ce7b8643bb91e70d0a6

  • C:\Users\Admin\AppData\Local\Temp\cCxU1ckGow3RVLT.exe

    Filesize

    25KB

    MD5

    d7d63737853abe2960d670437da4b038

    SHA1

    af44e0714cdbe631d3081f2146e8e955fc85f552

    SHA256

    4eb6400eb79e4ae64caf8702785e0642c50ba51cfbdcb0584266a17091d7b83b

    SHA512

    1fdca9d71a1252e7c13e7b878b9f08bc4e00dbc085154a9bd6a7b4c087a4facb49f194d73ef6b384d9423bec679ba6a979be18ebfa992c88aa94f94f4ca63a66

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb