Analysis

  • max time kernel
    122s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 10:27

General

  • Target

    26e5f5d968b9ab5f0a80ff159a4749f58f50f16c3919dc640d7e2fab9ce165e0.exe

  • Size

    25KB

  • MD5

    e1ee0072ba4c186e37dac991419d1e85

  • SHA1

    a89d0c588a860571952144ad182b520b8647da75

  • SHA256

    26e5f5d968b9ab5f0a80ff159a4749f58f50f16c3919dc640d7e2fab9ce165e0

  • SHA512

    ebad5f61676fded91dce667d517f780c2c8dd97047d37b9cfb56556c0167d12ea3e96d1949f34b301f3945998743498964e19b970ac7e854e4f2e4c496bd11cc

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvNlJ:8Q3LotOPNSQVwVVxGKEvKHrVt

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26e5f5d968b9ab5f0a80ff159a4749f58f50f16c3919dc640d7e2fab9ce165e0.exe
    "C:\Users\Admin\AppData\Local\Temp\26e5f5d968b9ab5f0a80ff159a4749f58f50f16c3919dc640d7e2fab9ce165e0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:2200

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\XEvjZhonOH2H2wU.exe

    Filesize

    25KB

    MD5

    006114c624831a27999007e5a4590887

    SHA1

    a825da60c66450ac89583737b286ae0c5c9ce6a0

    SHA256

    a5200dc2a741b00506803c7c9c5d73f60c575fa919534f6ca2474287a3ec6ed4

    SHA512

    9e03bee993b0d66cf41bf83ce51c60f39bdea0fc4d7759006f6d280dbccc3bba0adf6dd72099e67c3c18fbeb06dc63d612723af0b66bd11488904c3d0a5857f2

  • C:\Users\Admin\AppData\Local\Temp\XEvjZhonOH2H2wU.exe

    Filesize

    25KB

    MD5

    006114c624831a27999007e5a4590887

    SHA1

    a825da60c66450ac89583737b286ae0c5c9ce6a0

    SHA256

    a5200dc2a741b00506803c7c9c5d73f60c575fa919534f6ca2474287a3ec6ed4

    SHA512

    9e03bee993b0d66cf41bf83ce51c60f39bdea0fc4d7759006f6d280dbccc3bba0adf6dd72099e67c3c18fbeb06dc63d612723af0b66bd11488904c3d0a5857f2

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb