ce10eaa14b7d7bc5db332fc8919afd05936c730ebb2d96085c382b3aceed836c

General

Target

a4e3688a6fd10182a51628fefd2489ee.exe
Size

307KB
MD5

a4e3688a6fd10182a51628fefd2489ee
SHA1

27246f4bff691cd09f8d952bb124ecc21a150e03
SHA256

ce10eaa14b7d7bc5db332fc8919afd05936c730ebb2d96085c382b3aceed836c
SHA512

a0d28a87bc762f0ae2ac3e69be2dfbc45387a6bdffbb7df2941a5626e15feec3e22d8bec8a7a6f8fcf0fe183588a1c98525cc33ba63bf2a787f276d725ffd5c5
SSDEEP

6144:nobAKJ0AmdwKoni3ktPW1Ibb5Yq6OxNYdNx4cYyZ+NHN1:nokKJ0AmdwKYiaPAGJ6OxidNxPYyQNt1

Score

8^/10

evasion spyware stealer

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Drops file in Windows directory 1 IoCs

Processes:

a4e3688a6fd10182a51628fefd2489ee.exe

description ioc process

File opened for modification \??\c:\windows\resources\55325ba0 a4e3688a6fd10182a51628fefd2489ee.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\55325ba0	a4e3688a6fd10182a51628fefd2489ee.exe

Modifies registry class 20 IoCs

Processes:

a4e3688a6fd10182a51628fefd2489ee.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\wdn.exe\" -a \"%1\" %*"	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\start\command	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\start	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\start\command\IsolatedCommand = "\"%1\" %*"	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\ = "Application"	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\Content Type = "application/x-msdownload"	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\DefaultIcon\ = "%1"	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\open\command	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\open\command\IsolatedCommand = "\"%1\" %*"	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\runas\command\ = "\"%1\" %*"	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\runas\command\IsolatedCommand = "\"%1\" %*"	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\runas\command	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\runas	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\start\command\ = "\"%1\" %*"	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell\open	a4e3688a6fd10182a51628fefd2489ee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\ = "grj"	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\DefaultIcon	a4e3688a6fd10182a51628fefd2489ee.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\grj\shell	a4e3688a6fd10182a51628fefd2489ee.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

a4e3688a6fd10182a51628fefd2489ee.exe

pid	process
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

a4e3688a6fd10182a51628fefd2489ee.exe

pid	process
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe
2256	a4e3688a6fd10182a51628fefd2489ee.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

a4e3688a6fd10182a51628fefd2489ee.exe

pid process

2256 a4e3688a6fd10182a51628fefd2489ee.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a4e3688a6fd10182a51628fefd2489ee.exe

pid process

2256 a4e3688a6fd10182a51628fefd2489ee.exe
2256 a4e3688a6fd10182a51628fefd2489ee.exe

C:\Users\Admin\AppData\Local\Temp\a4e3688a6fd10182a51628fefd2489ee.exe
"C:\Users\Admin\AppData\Local\Temp\a4e3688a6fd10182a51628fefd2489ee.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2256

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3040

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nba5524.tmp
Filesize
255B

MD5
cc3a9044ba12def527e60c38c4054302

SHA1
d9372ad941a3a3d72275c577a96efd6832708a3d

SHA256
0499cd2a7a855301b7a67b84401d51247a0d1fd99cd299adc49110988596b7b0

SHA512
736d3f924869cd760dc9c26acedf097b396afbd2165e6357a738ff5412f58ea793f4e97f5ad1bdcebcdf26819aa0e6637d9d87a753235e6b35f3c20c984d59f1

Download Submit
memory/2256-9-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2256-10-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-12-0x0000000000F80000-0x0000000001088000-memory.dmp

Filesize
1.0MB

Download
memory/2256-13-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-14-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-15-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-16-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-17-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-18-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-19-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-20-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-21-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-22-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-23-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download
memory/2256-24-0x0000000001160000-0x00000000011B0670-memory.dmp

Filesize
321KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads