d5f82f03fbfd363ae8af40c619bd91c2d5b5321453a4896d88c5656f08d9aea5

General

Target

2ea8eaf045248708bc4fcf60fa7a11be.exe
Size

323KB
MD5

2ea8eaf045248708bc4fcf60fa7a11be
SHA1

4f16a118948ac7f5725a4c2104eb9fa53888a460
SHA256

d5f82f03fbfd363ae8af40c619bd91c2d5b5321453a4896d88c5656f08d9aea5
SHA512

cc09a3e619214eea7ba39ade9aab6c84d11927ab99aad456e300ffeb57144d21362057df5715977c96874ceb94224a1a4e788ed7cb26548015c399e6b0a27f8e
SSDEEP

6144:NwkFThzZ+b678NJk0qKaIweEi/l5yo0O0cK0T7xBIHM:NwGhU+78E07aIzEy5aPUQs

Score

8^/10

evasion spyware stealer

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Drops file in Windows directory 1 IoCs

Processes:

2ea8eaf045248708bc4fcf60fa7a11be.exe

description ioc process

File opened for modification \??\c:\windows\resources\552d4984 2ea8eaf045248708bc4fcf60fa7a11be.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\552d4984	2ea8eaf045248708bc4fcf60fa7a11be.exe

Modifies registry class 20 IoCs

Processes:

2ea8eaf045248708bc4fcf60fa7a11be.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\DefaultIcon\ = "%1"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\open\command	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\unb.exe\" -a \"%1\" %*"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\runas	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\start\command	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\ = "Application"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\DefaultIcon	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\start	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\start\command\ = "\"%1\" %*"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\start\command\IsolatedCommand = "\"%1\" %*"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\open	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\open\command\IsolatedCommand = "\"%1\" %*"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\runas\command	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\Content Type = "application/x-msdownload"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.exe\ = "noa"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\runas\command\IsolatedCommand = "\"%1\" %*"	2ea8eaf045248708bc4fcf60fa7a11be.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\noa\shell\runas\command\ = "\"%1\" %*"	2ea8eaf045248708bc4fcf60fa7a11be.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

2ea8eaf045248708bc4fcf60fa7a11be.exe

pid	process
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

2ea8eaf045248708bc4fcf60fa7a11be.exe

pid	process
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe
2372	2ea8eaf045248708bc4fcf60fa7a11be.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

2ea8eaf045248708bc4fcf60fa7a11be.exe

pid process

2372 2ea8eaf045248708bc4fcf60fa7a11be.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2ea8eaf045248708bc4fcf60fa7a11be.exe

pid process

2372 2ea8eaf045248708bc4fcf60fa7a11be.exe
2372 2ea8eaf045248708bc4fcf60fa7a11be.exe

C:\Users\Admin\AppData\Local\Temp\2ea8eaf045248708bc4fcf60fa7a11be.exe
"C:\Users\Admin\AppData\Local\Temp\2ea8eaf045248708bc4fcf60fa7a11be.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fofFFA.tmp
Filesize
231B

MD5
208d8128f9ba069a185ba58373274755

SHA1
e303c5aa5b0794ce09258c2576cfd515b8d04183

SHA256
737db373e4ef4401979a219f6a222bda4dae3fe1b12e7e1a8554fce50fc2c692

SHA512
b4fb2cb5981d66ec591811d34bc7ec7080355ff9aa9b7e2f07a92e7444711acb325434624cd0d1f5a4036d70fa088608f5f55a001a5fc780a0ed2ae50fd2baec

Download Submit
memory/2372-9-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2372-11-0x0000000000CC0000-0x0000000000DC8000-memory.dmp

Filesize
1.0MB

Download
memory/2372-10-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-13-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-14-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-15-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-16-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-17-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-18-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-19-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-20-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-21-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-22-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-23-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-24-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download
memory/2372-25-0x0000000000E80000-0x0000000000ED5A94-memory.dmp

Filesize
342KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads