1324cdfa6a4602e5e5f8d52b646f16b46cfe517fdfd0c7f9c5cdb8cd713dfc90

General

Target

0b9a38a8e4d5d6644b6381cbbafcd3b8.exe
Size

694KB
MD5

0b9a38a8e4d5d6644b6381cbbafcd3b8
SHA1

c02ccd85f4614d4ea5b18dab76ce7f201e02a620
SHA256

1324cdfa6a4602e5e5f8d52b646f16b46cfe517fdfd0c7f9c5cdb8cd713dfc90
SHA512

bf998c90ddf6c177184e12365d955d0736d9b88ccc971cb0d052ed9e77a42fa835a217f0e1c57ef3b3316f3d9a699e1f04a3b378c1d16210b17082585741187f
SSDEEP

12288:t/aUsuYachgVK4RgIHfASiB3meKTC/sU0Yc9IItaWS:RaUxvxK4XHfA72eIbYc9IRWS

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	0b9a38a8e4d5d6644b6381cbbafcd3b8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	Descop.exe

Executes dropped EXE 2 IoCs

pid	Process
2200	Descop.exe
3360	RnWYjCxkk.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	Descop.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4900	1968	0b9a38a8e4d5d6644b6381cbbafcd3b8.exe	102
PID 1968 wrote to memory of 4900	1968	0b9a38a8e4d5d6644b6381cbbafcd3b8.exe	102
PID 1968 wrote to memory of 4900	1968	0b9a38a8e4d5d6644b6381cbbafcd3b8.exe	102
PID 4900 wrote to memory of 2200	4900	cmd.exe	106
PID 4900 wrote to memory of 2200	4900	cmd.exe	106
PID 4900 wrote to memory of 2200	4900	cmd.exe	106
PID 2200 wrote to memory of 4396	2200	Descop.exe	110
PID 2200 wrote to memory of 4396	2200	Descop.exe	110
PID 2200 wrote to memory of 4396	2200	Descop.exe	110
PID 2200 wrote to memory of 3360	2200	Descop.exe	111
PID 2200 wrote to memory of 3360	2200	Descop.exe	111
PID 2200 wrote to memory of 3360	2200	Descop.exe	111

C:\Users\Admin\AppData\Local\Temp\0b9a38a8e4d5d6644b6381cbbafcd3b8.exe
"C:\Users\Admin\AppData\Local\Temp\0b9a38a8e4d5d6644b6381cbbafcd3b8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\start.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Users\Admin\AppData\Roaming\Descop.exe
    Descop.exe -p123456 -dC:\Users\Admin\AppData\Roaming
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\логи.txt
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Roaming\RnWYjCxkk.exe
      "C:\Users\Admin\AppData\Roaming\RnWYjCxkk.exe"
      4⤵
      Executes dropped EXE
      PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vlmilolzyg24080.col

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Roaming\Descop.exe

Filesize
529KB

MD5
ce29e220137eaa81de4b08e98032cecb

SHA1
8e85a74e9ddff71bedf1e2f909a865e70e68010a

SHA256
7c77f307c7eab0ad8db790fdc065e5e1c5feeae4c823ed4d4b76c7907adc74a9

SHA512
5a6e8b28650d9659d9733c391f0670bd45ceef94fb8cc513b4574cfe3acc4cf16cd334850e63a373c10b1e455119f99c5ce48e9d22c2528566b67ab91048941a

Download Submit
C:\Users\Admin\AppData\Roaming\RnWYjCxkk.exe

Filesize
593KB

MD5
e1a37508f897388137fe8376bbc90581

SHA1
a537b28ceb41e4179b2377c4c466065ed4d1e511

SHA256
c811ce0e61e1b2529e7d9f50be3ed1adf67b640bf2332d3826163326235860b1

SHA512
d28aefc87db2cd7e496071602716754bcf009e229a4bd09beb57e5a848301228cb38061f390b195e49704d96005d72ba3bfea6bbf2f3632ceb57fac64897ade5

Download Submit
C:\Users\Admin\AppData\Roaming\start.bat

Filesize
31B

MD5
2d526503de8f0f3765ea43bfc84934ec

SHA1
a4b9fe9896876d45c63a8b8423d64b536f3033ff

SHA256
02125c7cc5f2e2920d43bd9f4654cee9bde03a03290d3f2d4d0e7710bba19c6b

SHA512
0863cbc3ec5db594e9e28613456cc792a261f05a727d45ba8de4e27c6b6be58d1807e8b5e5d789a50a8a65e8c72d867794a74bc2f2cd6cc3ff33152c627fc149

Download Submit
C:\Users\Admin\AppData\Roaming\логи.txt

Filesize
106KB

MD5
5f7762543210b662e6afeb1d98112256

SHA1
86b2e6b862c8b9c7c77558570f72287c83a2edda

SHA256
d8d36070c05a055ca13295e0343769c55278585719371c8c64dd8ae50f0937ba

SHA512
3ffdaed83de4078ccf57fe37ee2251831c53ea3192f565148a716f642680e9376febea508714e4f0280fabf7c77e6d19c864ac9a54cabeed609e5f0fb2046ebd

Download Submit

Analysis

Sharing