e5274609736cf066db15d7418cc0df5f23b193eafba2220c3c985030eabc8afa

General

Target

0e4669adca57eaf02ba2b384d0672def.exe
Size

428KB
MD5

0e4669adca57eaf02ba2b384d0672def
SHA1

75156e9ba54f4742b720d0f79b49b42d131e92b5
SHA256

e5274609736cf066db15d7418cc0df5f23b193eafba2220c3c985030eabc8afa
SHA512

45a9362f17ac566684193f8dadb2b1f027ce8155269599a8959b763e317993f273b53ffb22a76b88c71e662dbfd3511b9b0544883287c21fe695d92285f48c6c
SSDEEP

6144:hGyG9iocZTdbsjQX9/969y3vi5WKYtNwCClYkxHAy8/0iGDuuFA0fXfJ:h3Qcxwuv3a5WKYtNwbekFAy8/iPfXx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1832	EAZZghC4U7MXQcd.exe
2796	CTS.exe

Loads dropped DLL 1 IoCs

pid	Process
1664	0e4669adca57eaf02ba2b384d0672def.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000BE0000-0x0000000000BF7000-memory.dmp	upx
behavioral1/files/0x000b000000014be5-15.dat	upx
behavioral1/memory/1664-12-0x0000000000BE0000-0x0000000000BF7000-memory.dmp	upx
behavioral1/memory/1664-11-0x00000000000E0000-0x00000000000F7000-memory.dmp	upx
behavioral1/memory/2796-31-0x0000000000AB0000-0x0000000000AC7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	0e4669adca57eaf02ba2b384d0672def.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	0e4669adca57eaf02ba2b384d0672def.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	0e4669adca57eaf02ba2b384d0672def.exe
Token: SeDebugPrivilege	2796	CTS.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1832	1664	0e4669adca57eaf02ba2b384d0672def.exe	28
PID 1664 wrote to memory of 1832	1664	0e4669adca57eaf02ba2b384d0672def.exe	28
PID 1664 wrote to memory of 1832	1664	0e4669adca57eaf02ba2b384d0672def.exe	28
PID 1664 wrote to memory of 1832	1664	0e4669adca57eaf02ba2b384d0672def.exe	28
PID 1664 wrote to memory of 2796	1664	0e4669adca57eaf02ba2b384d0672def.exe	30
PID 1664 wrote to memory of 2796	1664	0e4669adca57eaf02ba2b384d0672def.exe	30
PID 1664 wrote to memory of 2796	1664	0e4669adca57eaf02ba2b384d0672def.exe	30
PID 1664 wrote to memory of 2796	1664	0e4669adca57eaf02ba2b384d0672def.exe	30

C:\Users\Admin\AppData\Local\Temp\0e4669adca57eaf02ba2b384d0672def.exe
"C:\Users\Admin\AppData\Local\Temp\0e4669adca57eaf02ba2b384d0672def.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\EAZZghC4U7MXQcd.exe
  C:\Users\Admin\AppData\Local\Temp\EAZZghC4U7MXQcd.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EAZZghC4U7MXQcd.exe

Filesize
92KB

MD5
0be85bd322917447f2530c368df85b3e

SHA1
7e4af36f77f6263e79d093f824f5957be03efbb7

SHA256
2d202ff576a92a3065376320bfff399d4fdfc198f2dcfc1c21b90522fe2e0b9b

SHA512
a0875958a1fd40030c4d0ae182e73fe3e635fb88c0c1aab2f61c0cd7a2d6103672c7e464f7fe39c9e7ce98302a413b2ed77c8ae5e33cc86b6b9e764e67d87fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\EAZZghC4U7MXQcd.exe

Filesize
369KB

MD5
c13927f8373c24ad2cab29a2df464993

SHA1
3b6e6bdf5413bde06c053756ad5de9c3c45bd46c

SHA256
e149002ba2f0a609d923ad553c1471d4988f18c64aaa28a708b7d5bc226bcb8a

SHA512
976d0ab66784eb59c81d795e87d3064b28692fd2bf39ccdd608b6cf63aae858a1e50380a62f67ea45d0019e39c1999b0657a7638539590b0e7f684829ebd937a

Download Submit
C:\Windows\CTS.exe

Filesize
59KB

MD5
5efd390d5f95c8191f5ac33c4db4b143

SHA1
42d81b118815361daa3007f1a40f1576e9a9e0bc

SHA256
6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74

SHA512
720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d

Download Submit
memory/1664-0-0x0000000000BE0000-0x0000000000BF7000-memory.dmp

Filesize
92KB

Download
memory/1664-14-0x00000000000E0000-0x00000000000F7000-memory.dmp

Filesize
92KB

Download
memory/1664-12-0x0000000000BE0000-0x0000000000BF7000-memory.dmp

Filesize
92KB

Download
memory/1664-11-0x00000000000E0000-0x00000000000F7000-memory.dmp

Filesize
92KB

Download
memory/1664-33-0x00000000000E0000-0x00000000000F7000-memory.dmp

Filesize
92KB

Download
memory/1832-20-0x0000000000150000-0x0000000000190000-memory.dmp

Filesize
256KB

Download
memory/1832-19-0x00000000741E0000-0x000000007478B000-memory.dmp

Filesize
5.7MB

Download
memory/1832-30-0x00000000741E0000-0x000000007478B000-memory.dmp

Filesize
5.7MB

Download
memory/2796-31-0x0000000000AB0000-0x0000000000AC7000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads