6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6

General

Target

6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe
Size

1.5MB
MD5

2f9e962a158e693ca6a80fbfa838a398
SHA1

3af4f9c301ee4a3909eb1c0e1a560d4737911861
SHA256

6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6
SHA512

02fb6471665c2919377e33df1d619a2fb82b66daffeb064030dfbde49a537a254660ee598b08bbfa1ba7a4eb9eaa452c27d69d42e834bec78dd5234d786fe9d3
SSDEEP

49152:II7+pxQKbNfnODWE1y0W7eO4JZ4HNW9EYEkfX:II7+pxnx8wFP4J4WWYEWX

Score

8^/10

execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2392	powershell.exe

.NET Reactor proctector 3 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/2292-1-0x00000000012D0000-0x000000000145C000-memory.dmp	net_reactor
behavioral1/files/0x001a000000012300-9.dat	net_reactor
behavioral1/memory/2632-16-0x0000000000320000-0x00000000004AC000-memory.dmp	net_reactor

Executes dropped EXE 1 IoCs

pid	Process
2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2392	powershell.exe
2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe
Token: SeDebugPrivilege	2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2632	2292	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	29
PID 2292 wrote to memory of 2632	2292	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	29
PID 2292 wrote to memory of 2632	2292	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	29
PID 2292 wrote to memory of 2632	2292	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	29
PID 2632 wrote to memory of 2456	2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	30
PID 2632 wrote to memory of 2456	2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	30
PID 2632 wrote to memory of 2456	2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	30
PID 2632 wrote to memory of 2456	2632	6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe	30
PID 2456 wrote to memory of 2392	2456	cmd.exe	32
PID 2456 wrote to memory of 2392	2456	cmd.exe	32
PID 2456 wrote to memory of 2392	2456	cmd.exe	32
PID 2456 wrote to memory of 2392	2456	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe
"C:\Users\Admin\AppData\Local\Temp\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Accounts.ControlRCP_ruzxpnew4af\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Accounts.ControlRCP_ruzxpnew4af\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Accounts.ControlRCP_ruzxpnew4af\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Accounts.ControlRCP_ruzxpnew4af\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Accounts.ControlRCP_ruzxpnew4af\LocalState\config.json

Filesize
269B

MD5
49a664e7abae4fe62986418255a80b22

SHA1
a3f28d1ecda62ebd740e198afaa1b240d9aaa3a7

SHA256
faec90d15ebefaed1139a98269907348567994807e891faf2a3002da58a7fc24

SHA512
fc7496bc251eb5cff3301717d2a1ccf28cb0c5c3ea3065c643a465011cc2dd31825895079af73a9a0a84feb55d49c9ae75e852ab66cc11013bfa5a57b2723fdb

Download Submit
\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Accounts.ControlRCP_ruzxpnew4af\6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6.exe

Filesize
1.5MB

MD5
2f9e962a158e693ca6a80fbfa838a398

SHA1
3af4f9c301ee4a3909eb1c0e1a560d4737911861

SHA256
6f8e28de8a556a784361870ad03cbcfcd664072ce2be4f2d42cd3b19158238c6

SHA512
02fb6471665c2919377e33df1d619a2fb82b66daffeb064030dfbde49a537a254660ee598b08bbfa1ba7a4eb9eaa452c27d69d42e834bec78dd5234d786fe9d3

Download Submit
memory/2292-1-0x00000000012D0000-0x000000000145C000-memory.dmp

Filesize
1.5MB

Download
memory/2292-2-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-3-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2292-4-0x0000000005010000-0x0000000005114000-memory.dmp

Filesize
1.0MB

Download
memory/2292-5-0x0000000004860000-0x0000000004912000-memory.dmp

Filesize
712KB

Download
memory/2292-6-0x0000000000C20000-0x0000000000C3A000-memory.dmp

Filesize
104KB

Download
memory/2292-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2292-14-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-15-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-17-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-18-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-19-0x0000000005570000-0x00000000055C8000-memory.dmp

Filesize
352KB

Download
memory/2632-24-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-16-0x0000000000320000-0x00000000004AC000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing