1622cc5cee3c0ce49f88d8db78c1d6af35a62083ab50573448bcc4ff175c891c

Analysis

max time kernel
153s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b5d522f7984b06107ec79805b727e8.exe
Size

3.4MB
MD5

59b5d522f7984b06107ec79805b727e8
SHA1

4ab71f90d3aea09297d8686d8e02e12bfc566ee0
SHA256

1622cc5cee3c0ce49f88d8db78c1d6af35a62083ab50573448bcc4ff175c891c
SHA512

3a7c09226e32192c8e1f9003ce05e9c047c21f460edcf53130f9147efe09a110ec3351b9399935842382548543a9702d6e536dd8567a4cc175b5bb4fe19adee7
SSDEEP

98304:IRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/PL:Ikj8NBFwxpNOuk2y

Score

8^/10

evasion spyware stealer

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
2644	kPYOTg8he3M.exe

Executes dropped EXE 2 IoCs

pid	Process
2644	kPYOTg8he3M.exe
1248	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
1184	59b5d522f7984b06107ec79805b727e8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2272	sc.exe
2932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1184	59b5d522f7984b06107ec79805b727e8.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe
2644	kPYOTg8he3M.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	59b5d522f7984b06107ec79805b727e8.exe
Token: SeDebugPrivilege	2644	kPYOTg8he3M.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2644	1184	59b5d522f7984b06107ec79805b727e8.exe	28
PID 1184 wrote to memory of 2644	1184	59b5d522f7984b06107ec79805b727e8.exe	28
PID 1184 wrote to memory of 2644	1184	59b5d522f7984b06107ec79805b727e8.exe	28
PID 2644 wrote to memory of 2592	2644	kPYOTg8he3M.exe	29
PID 2644 wrote to memory of 2592	2644	kPYOTg8he3M.exe	29
PID 2644 wrote to memory of 2592	2644	kPYOTg8he3M.exe	29
PID 2592 wrote to memory of 2272	2592	cmd.exe	31
PID 2592 wrote to memory of 2272	2592	cmd.exe	31
PID 2592 wrote to memory of 2272	2592	cmd.exe	31
PID 2592 wrote to memory of 2932	2592	cmd.exe	32
PID 2592 wrote to memory of 2932	2592	cmd.exe	32
PID 2592 wrote to memory of 2932	2592	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\59b5d522f7984b06107ec79805b727e8.exe
"C:\Users\Admin\AppData\Local\Temp\59b5d522f7984b06107ec79805b727e8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\kPYOTg8he3M.exe
  "C:\Users\Admin\AppData\Local\Temp\kPYOTg8he3M.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDU5YjVkNTIyZjc5ODRiMDYxMDdlYzc5ODA1YjcyN2U4LmV4ZQ==
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\sc.exe
      sc stop "SysMain"
      4⤵
      Launches sc.exe
      PID:2272
  - - C:\Windows\system32\sc.exe
      sc config "SysMain" start=disabled
      4⤵
      Launches sc.exe
      PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kPYOTg8he3M.exe

Filesize
3.4MB

MD5
920adc9f30e578167ea42e049b19ea1f

SHA1
804b5e5891367f6e85b7df3bcad7345facbd0957

SHA256
d656dee3963c6ba47f8b5dfa2e6fdd78200fcdc8b3616da70b4aea717ec05856

SHA512
863b7211b9a5711832d6e7d1078123b7c4917e14e15cb2525798f532d84d38352ca64c9dffa9dbdcfc6d38516de084f983cf97336b0bcc0f43228c2ec7af405e

Download Submit
\Users\Admin\AppData\Local\Temp\kPYOTg8he3M.exe

Filesize
3.3MB

MD5
48236c70f6850c11cb1d638b8a213b96

SHA1
cecc4552c293699cb3be52ca98a5d94f7f732dfd

SHA256
71013d2abfe61b56880fb1a932f7b6f6c2dab9f751584334157cd6b22fad7900

SHA512
c55d506d1eff36adf2d9ad6db7b0273f85fb866775459accbce08949c71bcc252ead8952fedf75522825f2991d9add8d871584eae401168aed4a779722a4056b

Download Submit
memory/1184-6-0x0000000000170000-0x0000000000174000-memory.dmp

Filesize
16KB

Download
memory/1184-3-0x0000000002460000-0x00000000024E0000-memory.dmp

Filesize
512KB

Download
memory/1184-4-0x0000000000140000-0x0000000000170000-memory.dmp

Filesize
192KB

Download
memory/1184-5-0x000000001D160000-0x000000001D598000-memory.dmp

Filesize
4.2MB

Download
memory/1184-23-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/1184-7-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1184-8-0x0000000000660000-0x00000000006FC000-memory.dmp

Filesize
624KB

Download
memory/1184-9-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/1184-10-0x0000000000900000-0x0000000000932000-memory.dmp

Filesize
200KB

Download
memory/1184-11-0x0000000000930000-0x0000000000934000-memory.dmp

Filesize
16KB

Download
memory/1184-2-0x000000001C350000-0x000000001C640000-memory.dmp

Filesize
2.9MB

Download
memory/1184-1-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/1184-0-0x000000013FA90000-0x000000013FDB4000-memory.dmp

Filesize
3.1MB

Download
memory/2644-20-0x000000013F9F0000-0x000000013FD14000-memory.dmp

Filesize
3.1MB

Download
memory/2644-22-0x000000001BA30000-0x000000001BAB0000-memory.dmp

Filesize
512KB

Download
memory/2644-21-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/2644-24-0x0000000002260000-0x00000000022D2000-memory.dmp

Filesize
456KB

Download
memory/2644-25-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/2644-27-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/2644-26-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/2644-29-0x000000001BA30000-0x000000001BAB0000-memory.dmp

Filesize
512KB

Download
memory/2644-30-0x000007FEF5990000-0x000007FEF637C000-memory.dmp

Filesize
9.9MB

Download
memory/2644-31-0x000000001BA30000-0x000000001BAB0000-memory.dmp

Filesize
512KB

Download
memory/2644-32-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/2644-33-0x0000000002190000-0x000000000219A000-memory.dmp

Filesize
40KB

Download
memory/2644-34-0x000000001BA30000-0x000000001BAB0000-memory.dmp

Filesize
512KB

Download