4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98

General

Target

4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe
Size

123KB
MD5

288759a2ddb0ba4684214fe26a47b354
SHA1

d8a28e1baf9b0287c8cd353f70d0846bc8d5883a
SHA256

4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98
SHA512

c858fd2070c1bc51ee7e128cb783a515827c093e39d46ea8e9426e1eb777f9ed8742c4f6e49ce446e1f316d405dbefb101b6605bef71b5d7af320aeb39d14033
SSDEEP

1536:KcNjQlsWjcd+xzl7SMQ2AeoZNMOoaBlw+pC43HXgQZxTYFjh3v9kzFy90TQpdze7:1jr87Sb2zorlUj431a93v0TMp9e6LCGy

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2988	9yaqUqfJSkMRGzf.exe
2916	CTS.exe

Loads dropped DLL 2 IoCs

pid	Process
2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe
2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe
File created	C:\Windows\CTS.exe	CTS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe
Token: SeDebugPrivilege	2916	CTS.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2988	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	28
PID 2932 wrote to memory of 2988	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	28
PID 2932 wrote to memory of 2988	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	28
PID 2932 wrote to memory of 2988	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	28
PID 2932 wrote to memory of 2916	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	30
PID 2932 wrote to memory of 2916	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	30
PID 2932 wrote to memory of 2916	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	30
PID 2932 wrote to memory of 2916	2932	4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe	30

C:\Users\Admin\AppData\Local\Temp\4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe
"C:\Users\Admin\AppData\Local\Temp\4ae2c05af43eb24f22f4bf12bf6ef34566a9579fed9eb2dbe9efad870c177a98.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\9yaqUqfJSkMRGzf.exe
  C:\Users\Admin\AppData\Local\Temp\9yaqUqfJSkMRGzf.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9yaqUqfJSkMRGzf.exe

Filesize
123KB

MD5
071d805608c04c2ee1b3ddf514a0775e

SHA1
55262b5065bdfeaf97b0abbf6996146be909718c

SHA256
69cebf536e9d42ca48ffe2b96a9a3335f4774f58ecbf77f8cf04d2a52b6870a1

SHA512
03ea45caac887f1d3c91cdbc447521cf283f71628a3140ce62dbd2fccaf2729330cac1a5f53e8e02cb840ded4e3a4c0956f3aab1bee835a89ddb72ccecf4cf07

Download Submit
C:\Windows\CTS.exe

Filesize
59KB

MD5
a7013fd980137854a484ddae4db165c5

SHA1
726b485772138de438aa549bcd271e74cc155969

SHA256
cae4dd6e200b11cc20962b41914be7a9c5c732e88d54169b42f010b48c5b2431

SHA512
f1e8fad2ebadd68f86b6010ec65144f40003c646aac36ca2ae0d9060b6fb688be8241a401b507633ff7633ed6713294d15122b5561cd1b0a7c4cdda8458912ee

Download Submit
\Users\Admin\AppData\Local\Temp\9yaqUqfJSkMRGzf.exe

Filesize
64KB

MD5
a32a382b8a5a906e03a83b4f3e5b7a9b

SHA1
11e2bdd0798761f93cce363329996af6c17ed796

SHA256
75f12ea2f30d9c0d872dade345f30f562e6d93847b6a509ba53beec6d0b2c346

SHA512
ec87dd957be21b135212454646dcabdd7ef9442cf714e2c1f6b42b81f0c3fa3b1875bde9a8b538e8a0aa2190225649c29e9ed0f25176e7659e55e422dd4efe4c

Download Submit
memory/2916-15-0x00000000013E0000-0x00000000013F3000-memory.dmp

Filesize
76KB

Download
memory/2932-0-0x0000000000A20000-0x0000000000A33000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads