39edfee7d8e308dfa08f9c4a2ee8ccba31bb306a4a3d2299791c3f5ba9c4c1d9

General

Target

7c3c4dba11f7ad2d331e296e891e37d4.exe
Size

359KB
MD5

7c3c4dba11f7ad2d331e296e891e37d4
SHA1

c2c14821531149b741ab120ef94d94e2509aa336
SHA256

39edfee7d8e308dfa08f9c4a2ee8ccba31bb306a4a3d2299791c3f5ba9c4c1d9
SHA512

358f59e90e5d9268e03e46f73ede3d17dac1b797dcd37304058bfba7edd589542ab14947f425aa9d02338e6a99065222ac200fff41b7d0444073f7fe2a0d755b
SSDEEP

6144:k+q9Lj0M7frQMU4SobPojsZn3kjv96Gq64/G+i75voDwlwTOKZ:shj0Kd1PoIk0xjPM5vQ

Score

8^/10

evasion spyware stealer

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\5439a31a	7c3c4dba11f7ad2d331e296e891e37d4.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\Content Type = "application/x-msdownload"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\open	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ato.exe\" -a \"%1\" %*"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\open\command\IsolatedCommand = "\"%1\" %*"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\runas	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\runas\command\IsolatedCommand = "\"%1\" %*"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.exe	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\ = "Application"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\runas\command	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\start\command	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\start\command\ = "\"%1\" %*"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\DefaultIcon	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\open\command	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\runas\command\ = "\"%1\" %*"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.exe\ = "dk"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\DefaultIcon\ = "%1"	7c3c4dba11f7ad2d331e296e891e37d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\start	7c3c4dba11f7ad2d331e296e891e37d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\dk\shell\start\command\IsolatedCommand = "\"%1\" %*"	7c3c4dba11f7ad2d331e296e891e37d4.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe
2208	7c3c4dba11f7ad2d331e296e891e37d4.exe

C:\Users\Admin\AppData\Local\Temp\7c3c4dba11f7ad2d331e296e891e37d4.exe
"C:\Users\Admin\AppData\Local\Temp\7c3c4dba11f7ad2d331e296e891e37d4.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-6-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2208-7-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-8-0x0000000000440000-0x0000000000548000-memory.dmp

Filesize
1.0MB

Download
memory/2208-10-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-11-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-12-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-13-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-14-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-15-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-16-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-17-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-18-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-19-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-20-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-21-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-22-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-23-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download
memory/2208-24-0x0000000000220000-0x000000000027D3CC-memory.dmp

Filesize
372KB

Download

Analysis

Sharing