f7a062cbdd22f2bd346f704ba3d4e1ca864ec525a4fa96ac2be1991faeeb5690

General

Target

Open Invoices.exe
Size

638KB
MD5

3cf50c15d2c08abbcfcc58ee94ae75fd
SHA1

a170cfc66096715badfbce43cc0a3c18d5fd6d28
SHA256

f7a062cbdd22f2bd346f704ba3d4e1ca864ec525a4fa96ac2be1991faeeb5690
SHA512

0f90ba0ab8ef780a65286a335a9121c9eb5e8d88f6322bcf671b0cb44d954c1c1b9c268df4a754840e0866704f9e9ba467faa4133f0dbb92f0360a8cc903b254
SSDEEP

12288:gvoYmDHvCRKUletwzaDOPObzFhHvOj8nahu8nPQ5USkPlTAbCsLCmLB:gvobXUleqW7FhHvaTkuPQNYTAbbLhLB

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2576	2372	Open Invoices.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2776	powershell.exe
2576	Open Invoices.exe
2576	Open Invoices.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2576	Open Invoices.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2776	2372	Open Invoices.exe	30
PID 2372 wrote to memory of 2776	2372	Open Invoices.exe	30
PID 2372 wrote to memory of 2776	2372	Open Invoices.exe	30
PID 2372 wrote to memory of 2776	2372	Open Invoices.exe	30
PID 2372 wrote to memory of 2884	2372	Open Invoices.exe	33
PID 2372 wrote to memory of 2884	2372	Open Invoices.exe	33
PID 2372 wrote to memory of 2884	2372	Open Invoices.exe	33
PID 2372 wrote to memory of 2884	2372	Open Invoices.exe	33
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34
PID 2372 wrote to memory of 2576	2372	Open Invoices.exe	34

C:\Users\Admin\AppData\Local\Temp\Open Invoices.exe
"C:\Users\Admin\AppData\Local\Temp\Open Invoices.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dYlKXmBLyq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYlKXmBLyq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3A2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2884
- C:\Users\Admin\AppData\Local\Temp\Open Invoices.exe
  "C:\Users\Admin\AppData\Local\Temp\Open Invoices.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF3A2.tmp

Filesize
1KB

MD5
000f1db59b41abdb1ef8f9a9c9897a32

SHA1
bf8bb412900c288a7b9cbb8739a759060de95449

SHA256
aed8b5066a9ffabec28e1fd5f34d6bc2247639e59bd58c71fdab6dd63ca46d27

SHA512
ed6b71a39043f689f170dd2b99154ecc41e5506cb1e8dd10630efdada5aa8881c72b48829476726d12ecc013d5c54aaa9953d818d899c7a78e7593ef1400605a

Download Submit
memory/2372-0-0x0000000001280000-0x0000000001326000-memory.dmp

Filesize
664KB

Download
memory/2372-1-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-2-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2372-3-0x0000000000430000-0x0000000000446000-memory.dmp

Filesize
88KB

Download
memory/2372-4-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-5-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2372-6-0x0000000000450000-0x0000000000460000-memory.dmp

Filesize
64KB

Download
memory/2372-7-0x0000000005130000-0x00000000051AA000-memory.dmp

Filesize
488KB

Download
memory/2372-38-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-42-0x0000000001210000-0x0000000001250000-memory.dmp

Filesize
256KB

Download
memory/2576-41-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-37-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-39-0x0000000001210000-0x0000000001250000-memory.dmp

Filesize
256KB

Download
memory/2576-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2576-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2576-34-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2776-17-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2776-16-0x000000006E1B0000-0x000000006E75B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-15-0x000000006E1B0000-0x000000006E75B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-21-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2776-20-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2776-40-0x000000006E1B0000-0x000000006E75B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-19-0x000000006E1B0000-0x000000006E75B000-memory.dmp

Filesize
5.7MB

Download
memory/2776-18-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads