6398d8ab770748ba06958dc0b7ef0528ea97d518b889e26e1cdaab642da6be17

General

Target

palebreast.exe
Size

1.2MB
MD5

80a929ed8c5c4aadc9fb589baf5b3c5c
SHA1

49254388bb2926b6b7c6a3846121aaa001639c7a
SHA256

6398d8ab770748ba06958dc0b7ef0528ea97d518b889e26e1cdaab642da6be17
SHA512

d0046618e4d7151d1338e36dceef31598ac75ed49506ed31a1f290479e8242f5b6bee3fc68e9f1da0194a73aa2899a2eef81d5d59bd705e01217c128daa03fb0
SSDEEP

24576:+mFPqmsbqk95ACjKC4onl8Q3wlRjMPybTJmUU:nPdIACjKCxl13ojMPyblG

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
16	1980	wscript.exe

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	palebreast.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	palebreast.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Control Panel\International\Geo\Nation	palebreast.exe

Loads dropped DLL 2 IoCs

pid	Process
2880	palebreast.exe
1980	wscript.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2760	palebreast.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2880	palebreast.exe
2760	palebreast.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2880 set thread context of 2760	2880	palebreast.exe	30
PID 2760 set thread context of 1268	2760	palebreast.exe	22
PID 2760 set thread context of 1980	2760	palebreast.exe	33
PID 1980 set thread context of 1268	1980	wscript.exe	22

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3849525425-30183055-657688904-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wscript.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2760	palebreast.exe
2760	palebreast.exe
2760	palebreast.exe
2760	palebreast.exe
2760	palebreast.exe
2760	palebreast.exe
2760	palebreast.exe
2760	palebreast.exe
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2880	palebreast.exe
2760	palebreast.exe
1268	Explorer.EXE
1268	Explorer.EXE
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe
1980	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	palebreast.exe
Token: SeDebugPrivilege	1980	wscript.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2760	2880	palebreast.exe	30
PID 2880 wrote to memory of 2760	2880	palebreast.exe	30
PID 2880 wrote to memory of 2760	2880	palebreast.exe	30
PID 2880 wrote to memory of 2760	2880	palebreast.exe	30
PID 2880 wrote to memory of 2760	2880	palebreast.exe	30
PID 2880 wrote to memory of 2760	2880	palebreast.exe	30
PID 1268 wrote to memory of 1980	1268	Explorer.EXE	33
PID 1268 wrote to memory of 1980	1268	Explorer.EXE	33
PID 1268 wrote to memory of 1980	1268	Explorer.EXE	33
PID 1268 wrote to memory of 1980	1268	Explorer.EXE	33
PID 1980 wrote to memory of 292	1980	wscript.exe	35
PID 1980 wrote to memory of 292	1980	wscript.exe	35
PID 1980 wrote to memory of 292	1980	wscript.exe	35
PID 1980 wrote to memory of 292	1980	wscript.exe	35
PID 1980 wrote to memory of 292	1980	wscript.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\palebreast.exe
  "C:\Users\Admin\AppData\Local\Temp\palebreast.exe"
  2⤵
  - Checks QEMU agent file
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\palebreast.exe
    "C:\Users\Admin\AppData\Local\Temp\palebreast.exe"
    3⤵
    - Checks QEMU agent file
    - Checks computer location settings
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\u0p8n2n8.zip

Filesize
420KB

MD5
e52817a24225cd74cf2572296e89e97a

SHA1
b8df50b6fa53542824387439298c3abde19b60aa

SHA256
3eba4df40a820b1b646b312554974a764c513a8318ec9fa414937220cdf6d343

SHA512
52918142caba7e160973787cf4da1e0550face70396c55c4de3771ad2d60bdbb6d71e10f0a4cb5e38ae77fb39effbe945b8bd9c2c3185aff16ce1173f375572b

Download Submit
\Users\Admin\AppData\Local\Temp\nso85A5.tmp\System.dll

Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
804KB

MD5
b09588d000ef4bf2a3dddd85bd701423

SHA1
44a810ff8920a340a30b66d932253555143dc28b

SHA256
ce4ffc1a12150b8523378553f2a97dd3fc44d5210ae6c296ab31e2c78f0d03c3

SHA512
1d807d92da34ccba4628f2a55c3ac1c03ff63925d79e266b4e52d71002228cbde76206ec696c3e25143fc2e0cab56589155666ff6f8ea0ebfd5ebcd362168e2a

Download Submit
memory/1268-77-0x00000000046D0000-0x00000000047C4000-memory.dmp

Filesize
976KB

Download
memory/1268-74-0x00000000046D0000-0x00000000047C4000-memory.dmp

Filesize
976KB

Download
memory/1268-73-0x00000000046D0000-0x00000000047C4000-memory.dmp

Filesize
976KB

Download
memory/1268-70-0x00000000086E0000-0x000000000B44B000-memory.dmp

Filesize
45.4MB

Download
memory/1268-59-0x00000000086E0000-0x000000000B44B000-memory.dmp

Filesize
45.4MB

Download
memory/1980-63-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1980-76-0x00000000003D0000-0x000000000046E000-memory.dmp

Filesize
632KB

Download
memory/1980-75-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1980-118-0x0000000061E00000-0x0000000061EB6000-memory.dmp

Filesize
728KB

Download
memory/1980-71-0x00000000003D0000-0x000000000046E000-memory.dmp

Filesize
632KB

Download
memory/1980-68-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/1980-66-0x0000000002220000-0x0000000002523000-memory.dmp

Filesize
3.0MB

Download
memory/1980-64-0x0000000000070000-0x00000000000A6000-memory.dmp

Filesize
216KB

Download
memory/2760-48-0x0000000001470000-0x00000000052EC000-memory.dmp

Filesize
62.5MB

Download
memory/2760-49-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-60-0x00000000000C0000-0x00000000000DF000-memory.dmp

Filesize
124KB

Download
memory/2760-58-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-65-0x0000000001470000-0x00000000052EC000-memory.dmp

Filesize
62.5MB

Download
memory/2760-52-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-67-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-51-0x0000000035690000-0x0000000035993000-memory.dmp

Filesize
3.0MB

Download
memory/2760-50-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-61-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-47-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-24-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download
memory/2760-23-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2760-22-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/2880-21-0x0000000074E70000-0x0000000074E76000-memory.dmp

Filesize
24KB

Download
memory/2880-20-0x0000000077B10000-0x0000000077BE6000-memory.dmp

Filesize
856KB

Download
memory/2880-19-0x0000000077920000-0x0000000077AC9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads