7ea6fdbf92b27f64a840b648a28f5ad916c6c0a32ee7097d3596c99462d03e64

General

Target

USD. 5000 + GST@18%.exe
Size

346KB
MD5

ec62d10ab5ff3a3e2044c0d423194384
SHA1

6b541b84665a2129c955a92280c471860c5ec841
SHA256

f24d0855c5866bb897239a3ed3ce49efce3b92e0c3544d01bfa825bd740c9c0a
SHA512

7a80009de692e21481d6e0ca1607551303587e4264e21b23d3129f8231643e6dad3e75dc665aa9d214276539271e0e463dbf10c5cd4dc90ef4caeda60a5825d8
SSDEEP

6144:pXFKo5ldU3CAggG8uH+T810WkhrDSGAdS2vlxvFHLkaOvS5AiZcUD6wNc5m/:pXRdaCunup0WkhrAdDH4aMStZcY6wNKm

Score

10^/10

persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
premium89.web-hosting.com
Port:
587
Username:
[email protected]
Password:
bles sing 20 23

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5048	iqyeu.exe
3388	iqyeu.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\easoxt = "C:\\Users\\Admin\\AppData\\Roaming\\xhcluqafoktdye\\nwsclgplu.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\iqyeu.exe\" "	iqyeu.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.ipify.org
38	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 3388	5048	iqyeu.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3388	iqyeu.exe
3388	iqyeu.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5048	iqyeu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	iqyeu.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 5048	2128	USD. 5000 + GST@18%.exe	86
PID 2128 wrote to memory of 5048	2128	USD. 5000 + GST@18%.exe	86
PID 2128 wrote to memory of 5048	2128	USD. 5000 + GST@18%.exe	86
PID 5048 wrote to memory of 3388	5048	iqyeu.exe	87
PID 5048 wrote to memory of 3388	5048	iqyeu.exe	87
PID 5048 wrote to memory of 3388	5048	iqyeu.exe	87
PID 5048 wrote to memory of 3388	5048	iqyeu.exe	87

C:\Users\Admin\AppData\Local\Temp\USD. 5000 + GST@18%.exe
"C:\Users\Admin\AppData\Local\Temp\USD. 5000 + GST@18%.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\iqyeu.exe
  "C:\Users\Admin\AppData\Local\Temp\iqyeu.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\iqyeu.exe
    "C:\Users\Admin\AppData\Local\Temp\iqyeu.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\evucjx.xts

Filesize
333KB

MD5
8a8a5e570b5171ccdf6417d407c3f95d

SHA1
dc46b801905e19671c3e5d28a9402f8327519066

SHA256
74e7ae2a7990d0cd64270a4fb0c8daa755fa88d61f61b02cd5aae6f0c6c930b2

SHA512
1e343172a7465f39a044d90a753cf4a153fdd20a9df870b00f4c54939d1418c8de823cfec3d293413d6dbcb93764e493c80554ebb5eede5b887ce329c214769e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqyeu.exe

Filesize
169KB

MD5
a47d426b55d746584db743d6467eaf60

SHA1
e123be247385a8f667dc7c1ab6311c5051fa5c0e

SHA256
39421c9db32de75abb5fc036021dbe282a4c2bc9f44011c8a7f4e51441652572

SHA512
b7a0a293085a717b54706b08ec38103bc1c80471d0dab7d22d5c5168c7e567098d8c0578aaa2653a1d0362307e5053676d978f06f2e4f3e14765ea695582feed

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqyeu.exe

Filesize
169KB

MD5
a47d426b55d746584db743d6467eaf60

SHA1
e123be247385a8f667dc7c1ab6311c5051fa5c0e

SHA256
39421c9db32de75abb5fc036021dbe282a4c2bc9f44011c8a7f4e51441652572

SHA512
b7a0a293085a717b54706b08ec38103bc1c80471d0dab7d22d5c5168c7e567098d8c0578aaa2653a1d0362307e5053676d978f06f2e4f3e14765ea695582feed

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqyeu.exe

Filesize
169KB

MD5
a47d426b55d746584db743d6467eaf60

SHA1
e123be247385a8f667dc7c1ab6311c5051fa5c0e

SHA256
39421c9db32de75abb5fc036021dbe282a4c2bc9f44011c8a7f4e51441652572

SHA512
b7a0a293085a717b54706b08ec38103bc1c80471d0dab7d22d5c5168c7e567098d8c0578aaa2653a1d0362307e5053676d978f06f2e4f3e14765ea695582feed

Download Submit
memory/3388-14-0x0000000074340000-0x0000000074AF0000-memory.dmp

Filesize
7.7MB

Download
memory/3388-17-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/3388-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3388-11-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3388-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3388-13-0x0000000074340000-0x0000000074AF0000-memory.dmp

Filesize
7.7MB

Download
memory/3388-26-0x0000000006DD0000-0x0000000006DDA000-memory.dmp

Filesize
40KB

Download
memory/3388-15-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/3388-16-0x0000000005510000-0x0000000005552000-memory.dmp

Filesize
264KB

Download
memory/3388-8-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3388-18-0x0000000005CC0000-0x0000000006264000-memory.dmp

Filesize
5.6MB

Download
memory/3388-19-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/3388-20-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/3388-21-0x0000000005810000-0x0000000005876000-memory.dmp

Filesize
408KB

Download
memory/3388-22-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/3388-23-0x0000000006C30000-0x0000000006C80000-memory.dmp

Filesize
320KB

Download
memory/3388-24-0x0000000006D20000-0x0000000006DBC000-memory.dmp

Filesize
624KB

Download
memory/3388-25-0x0000000006E60000-0x0000000006EF2000-memory.dmp

Filesize
584KB

Download
memory/5048-5-0x0000000000C80000-0x0000000000C82000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads