e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d

General

Target

e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
Size

41KB
MD5

80efd4ff53013850f56aa9a77b2b6697
SHA1

2600f94d0f7869fc77e32cc7289507d23dd0ef66
SHA256

e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d
SHA512

ed0bbf4babd7a8a700a8b92744f91eb008342a573be28410bf9075cf9de3e63dac68a23c31b3bef75925c6641dd9eba84fe8db154a33182f9322d5a1d017ce2c
SSDEEP

768:ljjAQ+BzWPEwnE+KHM2/XMNcnOkobBYZGbcIbMimtBlotuGZ4PFIbn4Vtmwo8:ljj3x85+Ks2/MSnOjkKWtjGZ4eb4Xmc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2056	r1AJw8nrrxJadLT.exe
1196	svhost.exe

Loads dropped DLL 3 IoCs

pid	Process
1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
2164	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
Token: SeDebugPrivilege	1196	svhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2056	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	28
PID 1576 wrote to memory of 2056	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	28
PID 1576 wrote to memory of 2056	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	28
PID 1576 wrote to memory of 2056	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	28
PID 1576 wrote to memory of 1196	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	29
PID 1576 wrote to memory of 1196	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	29
PID 1576 wrote to memory of 1196	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	29
PID 1576 wrote to memory of 1196	1576	e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe	29

C:\Users\Admin\AppData\Local\Temp\e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe
"C:\Users\Admin\AppData\Local\Temp\e3fd9619b66cdc32dd8aa521bd4dc356e66394ab94c277440e731ec11cbf489d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\r1AJw8nrrxJadLT.exe
  C:\Users\Admin\AppData\Local\Temp\r1AJw8nrrxJadLT.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Downloads\FormatReceive.exe

Filesize
913KB

MD5
86d7f37c161ab3d17b7ac89e193ad564

SHA1
ea9abff2e92c0ed65205f2fb4b28943f798b4e8c

SHA256
d3947fa21e3220ab8ce0ae01ce6ce85b8f3e41f178cd22837eb88ff7866e15ae

SHA512
2f2a201fe9c6ea841373a8aa9cec4e444e7e30e252f68e3ed3c418a1da74e8d790c2d7cff02a2ab7d8977136bc6042b80f12c5c473c153d86e79c4ba32ab49e6

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
5e7c375139b7453abd0b91a8a220f8e5

SHA1
88a3d645fab0f4129c1e485c90b593ab60e469ae

SHA256
36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8

SHA512
0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2

Download Submit
\Users\Admin\AppData\Local\Temp\r1AJw8nrrxJadLT.exe

Filesize
25KB

MD5
abbd49c180a2f8703f6306d6fa731fdc

SHA1
d63f4bfe7f74936b2fbace803e3da6103fbf6586

SHA256
5f411c0bd9ed9a42b0f07ed568c7d0cf358a83063b225a1f8f7da3296dde90f1

SHA512
290dd984acc451b778f3db8c510bae7aec1d9547c3ad0a1829df731c136e4ecc9a37dc6a786cf8f1ecc4d14339aed1288af25055f450f6f953138c8d4d5c36e9

Download Submit
memory/2056-14-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads