b804b753be765e9449600bb7dd46f36cbaa2bc92e29fe62f4e4bde26a1a87ae3

General

Target

030bad2f855ca0f00316ddd0bd266bbb.exe
Size

96KB
MD5

030bad2f855ca0f00316ddd0bd266bbb
SHA1

0576bf7d72f1e1e2e8e1ab60c3aa6e62d8b6f6e8
SHA256

b804b753be765e9449600bb7dd46f36cbaa2bc92e29fe62f4e4bde26a1a87ae3
SHA512

3343118d0daec3defcd823748fe3872666d3b14ddb99770f35bceaa6de18fdb94bcac267ad82beef7b9459181539390d4cdf1b97a8bb1601dc79eba09d2d1eba
SSDEEP

1536:ezDBda3hhnnFhrXzRGxfaBv7kqxgEEVa0:G9da3hhnFhrDu8vZue0

Score

10^/10

evasion persistence spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
darkwarrior

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	REG.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	030bad2f855ca0f00316ddd0bd266bbb.exe

Executes dropped EXE 1 IoCs

pid	Process
1140	Svchost.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Svchost.exe"	Svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1688	REG.exe
3912	REG.exe
4172	REG.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Svchost.exe:ZONE.identifier	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1140	Svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	Svchost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 2092	1112	030bad2f855ca0f00316ddd0bd266bbb.exe	92
PID 1112 wrote to memory of 2092	1112	030bad2f855ca0f00316ddd0bd266bbb.exe	92
PID 1112 wrote to memory of 2092	1112	030bad2f855ca0f00316ddd0bd266bbb.exe	92
PID 1112 wrote to memory of 1140	1112	030bad2f855ca0f00316ddd0bd266bbb.exe	93
PID 1112 wrote to memory of 1140	1112	030bad2f855ca0f00316ddd0bd266bbb.exe	93
PID 1112 wrote to memory of 1140	1112	030bad2f855ca0f00316ddd0bd266bbb.exe	93
PID 1140 wrote to memory of 1688	1140	Svchost.exe	94
PID 1140 wrote to memory of 1688	1140	Svchost.exe	94
PID 1140 wrote to memory of 1688	1140	Svchost.exe	94
PID 1140 wrote to memory of 4172	1140	Svchost.exe	99
PID 1140 wrote to memory of 4172	1140	Svchost.exe	99
PID 1140 wrote to memory of 4172	1140	Svchost.exe	99
PID 1140 wrote to memory of 3912	1140	Svchost.exe	98
PID 1140 wrote to memory of 3912	1140	Svchost.exe	98
PID 1140 wrote to memory of 3912	1140	Svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\030bad2f855ca0f00316ddd0bd266bbb.exe
"C:\Users\Admin\AppData\Local\Temp\030bad2f855ca0f00316ddd0bd266bbb.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - NTFS ADS
  PID:2092
- C:\Users\Admin\AppData\Roaming\Svchost.exe
  "C:\Users\Admin\AppData\Roaming\Svchost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - Modifies registry key
    PID:1688
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3912
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\HDOfgCDNkRuKqwQ.txt

Filesize
2B

MD5
bafd7322c6e97d25b6299b5d6fe8920b

SHA1
816c52fd2bdd94a63cd0944823a6c0aa9384c103

SHA256
1ea442a134b2a184bd5d40104401f2a37fbc09ccf3f4bc9da161c6099be3691d

SHA512
a145800e53a326d880f4b513436e54a0ab41efc8fdd4f038c0edae948e5ae08d2a7077d5bb648415078dda2571fe92c4d6fa2130a80f53d9dd329e7040729e81

Download Submit
C:\Users\Admin\AppData\Roaming\Svchost.exe

Filesize
96KB

MD5
030bad2f855ca0f00316ddd0bd266bbb

SHA1
0576bf7d72f1e1e2e8e1ab60c3aa6e62d8b6f6e8

SHA256
b804b753be765e9449600bb7dd46f36cbaa2bc92e29fe62f4e4bde26a1a87ae3

SHA512
3343118d0daec3defcd823748fe3872666d3b14ddb99770f35bceaa6de18fdb94bcac267ad82beef7b9459181539390d4cdf1b97a8bb1601dc79eba09d2d1eba

Download Submit
C:\Users\Admin\AppData\Roaming\qCkjXXyHTvPuSkw.txt

Filesize
70B

MD5
7f73bd56aefe2f4ea52867acc8f38792

SHA1
48b634644a1dcf7bf0b4b7aa37a0979cc03a6eeb

SHA256
8efa82676608fc0bb6f95c59a81bba429ca7314191ef218a5de3f912b9bf2236

SHA512
1119e0d2ed6a83b78ec74be64e71476462ffa58f442168951a6aa6eb64eae20897109769ce351820192c5aed021b8870616cc870e4d6d77d27eace238d6bf196

Download Submit
memory/1112-0-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/1112-1-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/1112-2-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/1112-16-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/1140-10-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/1140-11-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/1140-17-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads