e5274609736cf066db15d7418cc0df5f23b193eafba2220c3c985030eabc8afa

General

Target

0e4669adca57eaf02ba2b384d0672def.exe
Size

428KB
MD5

0e4669adca57eaf02ba2b384d0672def
SHA1

75156e9ba54f4742b720d0f79b49b42d131e92b5
SHA256

e5274609736cf066db15d7418cc0df5f23b193eafba2220c3c985030eabc8afa
SHA512

45a9362f17ac566684193f8dadb2b1f027ce8155269599a8959b763e317993f273b53ffb22a76b88c71e662dbfd3511b9b0544883287c21fe695d92285f48c6c
SSDEEP

6144:hGyG9iocZTdbsjQX9/969y3vi5WKYtNwCClYkxHAy8/0iGDuuFA0fXfJ:h3Qcxwuv3a5WKYtNwbekFAy8/iPfXx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4148	gUcWTFh5LgI2wUW.exe
1092	CTS.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1988-0-0x0000000000C80000-0x0000000000C97000-memory.dmp	upx
behavioral2/files/0x000600000002321e-6.dat	upx
behavioral2/memory/1988-7-0x0000000000C80000-0x0000000000C97000-memory.dmp	upx
behavioral2/memory/1092-9-0x0000000000750000-0x0000000000767000-memory.dmp	upx
behavioral2/files/0x0005000000022705-13.dat	upx
behavioral2/memory/1092-34-0x0000000000750000-0x0000000000767000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	0e4669adca57eaf02ba2b384d0672def.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	0e4669adca57eaf02ba2b384d0672def.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	0e4669adca57eaf02ba2b384d0672def.exe
Token: SeDebugPrivilege	1092	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4148	1988	0e4669adca57eaf02ba2b384d0672def.exe	87
PID 1988 wrote to memory of 4148	1988	0e4669adca57eaf02ba2b384d0672def.exe	87
PID 1988 wrote to memory of 4148	1988	0e4669adca57eaf02ba2b384d0672def.exe	87
PID 1988 wrote to memory of 1092	1988	0e4669adca57eaf02ba2b384d0672def.exe	89
PID 1988 wrote to memory of 1092	1988	0e4669adca57eaf02ba2b384d0672def.exe	89
PID 1988 wrote to memory of 1092	1988	0e4669adca57eaf02ba2b384d0672def.exe	89

C:\Users\Admin\AppData\Local\Temp\0e4669adca57eaf02ba2b384d0672def.exe
"C:\Users\Admin\AppData\Local\Temp\0e4669adca57eaf02ba2b384d0672def.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\gUcWTFh5LgI2wUW.exe
  C:\Users\Admin\AppData\Local\Temp\gUcWTFh5LgI2wUW.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
382KB

MD5
052ab2b4b8f327fcb954483ea0c68d2e

SHA1
35d3f989e575e804cdf79dabd9a96390cbcb213d

SHA256
17ba28c2b709e9915bb5cfd906fb2c377e935b21ef81614bafb0773d8f619322

SHA512
42c29cab32d0a094bc5ae9eee0a29440033fbcc852bbc9fe707677a82eaa459ce493188278fed1f92500f83a29de69f442ea189f370b920b41445f5f92126754

Download Submit
C:\Users\Admin\AppData\Local\Temp\gUcWTFh5LgI2wUW.exe

Filesize
80KB

MD5
63bf315d88cb88abf2d87994bb6cb0c4

SHA1
93d4fde3c2926efde41f36930c155dc63b9d44c4

SHA256
07234d48a6a3df5536d5ffbbcc50ce1563ecdb15010e4fe72f60aceb309640ea

SHA512
458e382fc13c1af6b30dfd1118f6b24b317e13becc61f4da56e977e9bc66e858a5e218bde6e19bc65f7ff532b7eee4d0933f9eb7288063b18b8d35565b9c23fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\gUcWTFh5LgI2wUW.exe

Filesize
143KB

MD5
2f17ca9b7249f1058ae2c6cc52997f35

SHA1
81a446b15e1ab05fd3b61f8469317c1577ec3076

SHA256
2ba19e9fc1b906d8d51ffb13096f751e182097891d6b6011969f8db8fc0b490e

SHA512
0460a419f62871fb79155d3e464afeffd705ab434685c31a01926acec5af8b18a6f3f735775bab784e7e03d2f042a6215529112815b2ed982bbbdbddd586db61

Download Submit
C:\Windows\CTS.exe

Filesize
59KB

MD5
5efd390d5f95c8191f5ac33c4db4b143

SHA1
42d81b118815361daa3007f1a40f1576e9a9e0bc

SHA256
6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74

SHA512
720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d

Download Submit
memory/1092-9-0x0000000000750000-0x0000000000767000-memory.dmp

Filesize
92KB

Download
memory/1092-34-0x0000000000750000-0x0000000000767000-memory.dmp

Filesize
92KB

Download
memory/1988-0-0x0000000000C80000-0x0000000000C97000-memory.dmp

Filesize
92KB

Download
memory/1988-7-0x0000000000C80000-0x0000000000C97000-memory.dmp

Filesize
92KB

Download
memory/4148-25-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/4148-27-0x00000000014B0000-0x00000000014C0000-memory.dmp

Filesize
64KB

Download
memory/4148-26-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download
memory/4148-38-0x0000000075340000-0x00000000758F1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads