e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651

General

Target

e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
Size

1.8MB
MD5

09f8786e67b013d415a5d0f5094fe912
SHA1

634b1b41dc92f30dc2fcca2d3da33fc7fb10f29d
SHA256

e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651
SHA512

0af7d63c80bc964fe2725e7654c63a1385606c54fca72457ee099a4d8045a5e22565f0b2cf10036397f7defe3be60e91e823bb61464ce017023b39789432fd94
SSDEEP

24576:j3vLR2VhZBJ905EmMyPnQxhe4/LwvHYgXkQJCtHYX6kDC/hR:j3dUZTHzLAlUQhK

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\K:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\O:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\Q:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\S:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\U:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\Y:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\B:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\E:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\G:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\I:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\J:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\P:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\A:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\L:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\M:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\N:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\X:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\R:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\T:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\V:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\W:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
File opened (read-only)	\??\Z:	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
Token: SeDebugPrivilege	4248	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
Token: SeDebugPrivilege	2920	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
Token: SeDebugPrivilege	2920	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 2920	4248	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe	91
PID 4248 wrote to memory of 2920	4248	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe	91
PID 4248 wrote to memory of 2920	4248	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe	91
PID 2920 wrote to memory of 4164	2920	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe	102
PID 2920 wrote to memory of 4164	2920	e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe	102

C:\Users\Admin\AppData\Local\Temp\e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
"C:\Users\Admin\AppData\Local\Temp\e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe
  "C:\Users\Admin\AppData\Local\Temp\e53c2f42d7359f98b0827889379eae42aa32bb454e57cf12949f39364594b651.exe" Admin
  2⤵
  - Drops file in Drivers directory
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm
    3⤵
    PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3732 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4060 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
1⤵
PID:980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4648 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
1⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4884 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5400 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:1
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2920-1-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/2920-5-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-6-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-7-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-9-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-10-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-14-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-16-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/2920-17-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/4248-0-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4248-4-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads