e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe
Size

17KB
MD5

9886387844b724ccba32b87acee4aaff
SHA1

aed0d7bd5ba6a82d5f46224844d2f3cdbc8350ce
SHA256

e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056
SHA512

4188108a383c5aff3f71f3ea7f53a9671507b231e6eea72535534abfa76c61813c121c23018ab0a0e9aa508f8b8f5f80e63f34bfc53e2cd77bab05d03b0ff081
SSDEEP

384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/FTk0S:IMAQ+BzWPEwnE+KHM2/O

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

5092 svhost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5092	svhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exesvhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

Processes:

e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exesvhost.exe

description	ioc	process
File created	C:\Windows\svhost.exe	e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exesvhost.exe

description	pid	process
Token: SeDebugPrivilege	1160	e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe
Token: SeDebugPrivilege	5092	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe

description	pid	process	target process
PID 1160 wrote to memory of 5092	1160	e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe	svhost.exe
PID 1160 wrote to memory of 5092	1160	e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe	svhost.exe
PID 1160 wrote to memory of 5092	1160	e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe	svhost.exe

C:\Users\Admin\AppData\Local\Temp\e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe
"C:\Users\Admin\AppData\Local\Temp\e5cb3d224a4cfad48b0f2e969517b1f36f30f3df6e740ec7847f14b99c7bb056.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\svhost.exe
"C:\Windows\svhost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
339KB

MD5
f06ddbb5c992e2774cc44cd8cb03fbd4

SHA1
efe6251507f99d081dfb0c29b0cdcf69d24feec2

SHA256
4e689f107b34f157863aa1c5041cc19ff7486c72d5f7db81d2bf63a1a50f044b

SHA512
f40ad189216ce767bb835771cb3f7e5df27c2f10dd2293369d37c04e46763cbe27ad4c5399a4b133c8cd7cbb8cf11996b073008dfb30c49f6f9789f4bb0f3dab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CNNAbwybVkbwQsd.exe
Filesize
17KB

MD5
be2233248399dc853a08c755b91074b6

SHA1
94cc1da02356435212c2efba2439c38f1d3cdbe1

SHA256
6efbe02ea12734f5574dc9c5cde3e8d6ce14f1fdac4a50e00b3aee5d5587e706

SHA512
21b06226e87d032d865429b54dbd25ff0e44553ce00a8ca9ba0eb0835a393516f0ee8dced626b017e984428ffaa6b6aef44dd75e0ec1bb45da2ddd5a23baedc1

Download Submit
C:\Windows\svhost.exe
Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit