53b4cb5b5078fc52c255a996e1870dabff9cd5a16af0103fb4807abf43a9cc4f

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1635b9e8e8903dd722f55536133cb1fd.exe
Size

169KB
MD5

1635b9e8e8903dd722f55536133cb1fd
SHA1

8789cd379d3d32b58ce55b6eec325e0b8f83c91c
SHA256

53b4cb5b5078fc52c255a996e1870dabff9cd5a16af0103fb4807abf43a9cc4f
SHA512

345a967c038e581008afc784b44bdaaf9e5ee1a98c9441f32c6da33caa4d8cf3db5558f4eced75b2b0a3d1d038829e3ce9807ae74914af3a929516f832cb8465
SSDEEP

3072:Vmy+mLhvDdC4psqLDSysGKrO7QqU/W9ffr1o0PyL0Kmnmw1zgsZVySHoUWIf:0y9O4G7rO7Qq+WNa0Y0znmAz3ian/f

Score

10^/10

persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\3B238\\99C6F.exe"	1635b9e8e8903dd722f55536133cb1fd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4340-1-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4784-12-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4340-41-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/392-103-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/392-102-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4340-105-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4340-176-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4340-178-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/4340-179-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4784	4340	1635b9e8e8903dd722f55536133cb1fd.exe	98
PID 4340 wrote to memory of 4784	4340	1635b9e8e8903dd722f55536133cb1fd.exe	98
PID 4340 wrote to memory of 4784	4340	1635b9e8e8903dd722f55536133cb1fd.exe	98
PID 4340 wrote to memory of 392	4340	1635b9e8e8903dd722f55536133cb1fd.exe	103
PID 4340 wrote to memory of 392	4340	1635b9e8e8903dd722f55536133cb1fd.exe	103
PID 4340 wrote to memory of 392	4340	1635b9e8e8903dd722f55536133cb1fd.exe	103

C:\Users\Admin\AppData\Local\Temp\1635b9e8e8903dd722f55536133cb1fd.exe
"C:\Users\Admin\AppData\Local\Temp\1635b9e8e8903dd722f55536133cb1fd.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\1635b9e8e8903dd722f55536133cb1fd.exe
  C:\Users\Admin\AppData\Local\Temp\1635b9e8e8903dd722f55536133cb1fd.exe startC:\Program Files (x86)\LP\6F03\6C4.exe%C:\Program Files (x86)\LP\6F03
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\1635b9e8e8903dd722f55536133cb1fd.exe
  C:\Users\Admin\AppData\Local\Temp\1635b9e8e8903dd722f55536133cb1fd.exe startC:\Program Files (x86)\38C62\lvvm.exe%C:\Program Files (x86)\38C62
  2⤵
  PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\3B238\8C62.B23

Filesize
996B

MD5
1c8f8f8bd05fb8abc24fcb9b5c5809de

SHA1
381ae29de0996d76adc3cf2be3380bd9da308987

SHA256
3a45dd9c7ac95df9a0e2ff1bdf326808df534fa736f12704aef05223fdabb1fa

SHA512
09a18aa152f049097f037b0b1eb6e94b64538b928eeed62142c14ec4b8f4c103c6d0b87dcc94caa0a64734bef968c911a26383996f819fdfafcdee3c38e05a3a

Download Submit
memory/392-104-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download
memory/392-102-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/392-103-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4340-105-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4340-41-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4340-1-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4340-2-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/4340-171-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/4340-176-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4340-178-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4340-179-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4784-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4784-173-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads