d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1

General

Target

d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
Size

5.6MB
MD5

1f14f2a77f388d6a6ffdd8f2dd556c38
SHA1

fed109591f58620ba86fc800971514ed8b95d4df
SHA256

d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1
SHA512

fa1668f1d3d0c25d095886c36ba7492efd8c09c69934b4ae8bf674a0bc4ae241d73f3ce5b0a219c2b2a3c288c720d4a6de68c931b76f1457ab5151f07c868c57
SSDEEP

49152:u2p+ZZx7qkrH0TZSqmtic94m46ORSmtic9:+Lx7qkrHi5mthum46ORSmth

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\1.exe"	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	1.exe
File opened (read-only)	\??\S:	1.exe
File opened (read-only)	\??\U:	1.exe
File opened (read-only)	\??\X:	1.exe
File opened (read-only)	\??\Z:	1.exe
File opened (read-only)	\??\Y:	1.exe
File opened (read-only)	\??\I:	1.exe
File opened (read-only)	\??\J:	1.exe
File opened (read-only)	\??\M:	1.exe
File opened (read-only)	\??\N:	1.exe
File opened (read-only)	\??\O:	1.exe
File opened (read-only)	\??\P:	1.exe
File opened (read-only)	\??\V:	1.exe
File opened (read-only)	\??\A:	1.exe
File opened (read-only)	\??\B:	1.exe
File opened (read-only)	\??\G:	1.exe
File opened (read-only)	\??\L:	1.exe
File opened (read-only)	\??\Q:	1.exe
File opened (read-only)	\??\T:	1.exe
File opened (read-only)	\??\W:	1.exe
File opened (read-only)	\??\E:	1.exe
File opened (read-only)	\??\K:	1.exe
File opened (read-only)	\??\R:	1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
2684	1.exe
2684	1.exe
2684	1.exe
2684	1.exe
2684	1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
2684	1.exe
2684	1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2684	2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe	28
PID 2880 wrote to memory of 2684	2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe	28
PID 2880 wrote to memory of 2684	2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe	28
PID 2880 wrote to memory of 2684	2880	d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe	28

C:\Users\Admin\AppData\Local\Temp\d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe
"C:\Users\Admin\AppData\Local\Temp\d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\1.exe
  C:\1.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.exe

Filesize
5.6MB

MD5
1f14f2a77f388d6a6ffdd8f2dd556c38

SHA1
fed109591f58620ba86fc800971514ed8b95d4df

SHA256
d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1

SHA512
fa1668f1d3d0c25d095886c36ba7492efd8c09c69934b4ae8bf674a0bc4ae241d73f3ce5b0a219c2b2a3c288c720d4a6de68c931b76f1457ab5151f07c868c57

Download Submit
C:\1.exe

Filesize
5.6MB

MD5
1f14f2a77f388d6a6ffdd8f2dd556c38

SHA1
fed109591f58620ba86fc800971514ed8b95d4df

SHA256
d97919753feb37b7c116f9a9dd8d77841701f440f96fdfa3d6b5a06ec48fc9b1

SHA512
fa1668f1d3d0c25d095886c36ba7492efd8c09c69934b4ae8bf674a0bc4ae241d73f3ce5b0a219c2b2a3c288c720d4a6de68c931b76f1457ab5151f07c868c57

Download Submit
C:\11.ini

Filesize
79B

MD5
d830992ba5f8e239f52bccf0ca589fce

SHA1
e31f83743fc42c6ed46a4e944a91c0adc51199db

SHA256
03bae907d8cd1ebcb08372b9b5d85b56c2f5580a93a295dccdc5f3d62a0573c5

SHA512
2d9e226be931d636d8f26e83117bba27ad0b19a16699a43c1d659ca2be20f1419bc89835171344291cf2ec6b3feb408ca1e1df38275f04dc9945199c285b5a93

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads