955845d615edd35bb26c29991d4d53809adbf39db9cc2466ce68fce86809699f

General

Target

be777a57f33c95b126066d4451ecdff9.exe
Size

52KB
MD5

be777a57f33c95b126066d4451ecdff9
SHA1

4013a62312b4917ba709ec484f5bbd93500130e1
SHA256

955845d615edd35bb26c29991d4d53809adbf39db9cc2466ce68fce86809699f
SHA512

e1f1d7786329da05f3e43ed7a277df837ae8e218089357d1ca1c3969d3f989d8bd969e710249edf2ef293307fb749c0692d10443f000baf877e83089380e7c6d
SSDEEP

1536:s9Z3KcR4mjD9r8226+CbG0rsX9CCKkIUF4:sr3KcWmjRrzSCJAX99KDR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1708	EMFmhSk1x2jb9H4.exe
1728	CTS.exe

Loads dropped DLL 3 IoCs

pid	Process
1444	be777a57f33c95b126066d4451ecdff9.exe
1444	be777a57f33c95b126066d4451ecdff9.exe
2136	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1444-0-0x0000000000CA0000-0x0000000000CB7000-memory.dmp	upx
behavioral1/memory/1444-13-0x0000000000CA0000-0x0000000000CB7000-memory.dmp	upx
behavioral1/memory/1728-17-0x00000000011F0000-0x0000000001207000-memory.dmp	upx
behavioral1/files/0x000b000000015cff-16.dat	upx
behavioral1/files/0x000b000000013a06-20.dat	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	be777a57f33c95b126066d4451ecdff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	be777a57f33c95b126066d4451ecdff9.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	be777a57f33c95b126066d4451ecdff9.exe
Token: SeDebugPrivilege	1728	CTS.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1708	1444	be777a57f33c95b126066d4451ecdff9.exe	28
PID 1444 wrote to memory of 1708	1444	be777a57f33c95b126066d4451ecdff9.exe	28
PID 1444 wrote to memory of 1708	1444	be777a57f33c95b126066d4451ecdff9.exe	28
PID 1444 wrote to memory of 1708	1444	be777a57f33c95b126066d4451ecdff9.exe	28
PID 1444 wrote to memory of 1728	1444	be777a57f33c95b126066d4451ecdff9.exe	30
PID 1444 wrote to memory of 1728	1444	be777a57f33c95b126066d4451ecdff9.exe	30
PID 1444 wrote to memory of 1728	1444	be777a57f33c95b126066d4451ecdff9.exe	30
PID 1444 wrote to memory of 1728	1444	be777a57f33c95b126066d4451ecdff9.exe	30

C:\Users\Admin\AppData\Local\Temp\be777a57f33c95b126066d4451ecdff9.exe
"C:\Users\Admin\AppData\Local\Temp\be777a57f33c95b126066d4451ecdff9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\EMFmhSk1x2jb9H4.exe
  C:\Users\Admin\AppData\Local\Temp\EMFmhSk1x2jb9H4.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EMFmhSk1x2jb9H4.exe

Filesize
52KB

MD5
e0e182f130abb6a04e99b810d00697a3

SHA1
a9f9f52634a17e162be757016bb5c61a5ee75940

SHA256
7f378d095eec7f316dcf0212301a7d1ea9f29e99483b6ba911055ffc4ef4df75

SHA512
8e4cd709917ac5d99598b8fd8108922c272393e61a3651c7f16ba9dd22b5f8dd4d605c84120529f32c8aae3390b0d3a934c4cfda6df283fad9f527643a58aa76

Download Submit
C:\Windows\CTS.exe

Filesize
35KB

MD5
93e5f18caebd8d4a2c893e40e5f38232

SHA1
fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6

SHA256
a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8

SHA512
986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54

Download Submit
\Users\Admin\AppData\Local\Temp\EMFmhSk1x2jb9H4.exe

Filesize
16KB

MD5
95c9a037d3b01a21275aa6cc73b122a2

SHA1
c19ed8afc95b91d0cc6bc075047de30eae015386

SHA256
1d5edcbae3258efb07cc57ba8d7cd1ebe2eb5106ef1a894b787ed2857952c523

SHA512
761bb76261712a597f610e3162fa1514d2f56d69d03d1b76b51c6b2a7b0c88bbd385b7dc849c6913f7d861fb3aed8551f26f640d90b621e8629abe2e4bfb6160

Download Submit
memory/1444-0-0x0000000000CA0000-0x0000000000CB7000-memory.dmp

Filesize
92KB

Download
memory/1444-13-0x0000000000CA0000-0x0000000000CB7000-memory.dmp

Filesize
92KB

Download
memory/1444-14-0x0000000000100000-0x0000000000117000-memory.dmp

Filesize
92KB

Download
memory/1444-25-0x0000000000100000-0x0000000000117000-memory.dmp

Filesize
92KB

Download
memory/1728-17-0x00000000011F0000-0x0000000001207000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads