12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
Size 17KB
Sample240603-llakzabe72
SHA256 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2
MD5 a7154b65cdfde85390a60b287ccc5d0e
SHA1 6663e3aabeaa93fa2af8748c4ccdf4b0c248f075
SHA512 d2bbde8f754cd4b535e33019ceff80d31c9c9776e1331c5fc91c889bdcb596e11df7ac3759c91a91ee7b88eb99d884451a2868c6170d4ede8470d534e4f41cc3
SSDEEP 384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/cION:IMAQ+BzWPEwnE+KHM2/YN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4232	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
Token: SeDebugPrivilege	4232	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4232	4760	12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe	93
PID 4760 wrote to memory of 4232	4760	12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe	93
PID 4760 wrote to memory of 4232	4760	12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe	93

C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe
"C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 339KB
SHA256 785cd8cea1625b3397bfd9bc6d1e273302125cc0abefc69ddf1777e15ed0fafd
MD5 bbe24692dcad2285aea0a46dc0703f19
SHA1 9d8103e0d837a13d39cbfb767ed95144d3e2f57d
SHA512 daa0e208e7f3879cea296265545376d54f29e64dc3132391c6ee0f820490d00227aba0ff773966d4b6802e30cef1ff8371e9c68e11dd43a8d53b87e170649d9a
SSDEEP 6144:thw+7dMMWHwY+MLCIrvCPzR1e4IqBIltqvay8CA0ZsmX+EEJuRYK:mZtFL9W7beZ1tqvaGvAEuA
MD5 SHA1 SHA512 SSDEEP

Submit Download

M4ubijsLqEbFso0.exe

Path C:\Users\Admin\AppData\Local\Temp\M4ubijsLqEbFso0.exe
Size 17KB
SHA256 cb987dec7eeb756ed88ea9d0a55f0cf6db23d93e957f0f540719b9cb4938157d
MD5 d3da8efce89e9311a03c2cf68d96f277
SHA1 7a95f3dae012d9e06da67c71e19ea3461ac567ec
SHA512 744487026665e66992cf168eb0fd50849cc88c25ddd300e95ae8f016cc8ca9521634e7a66c44b3838df7d894b4bb6cb2c7c2552e3724afbbb8ceaf830d65a3ee
SSDEEP 192:nx+uPBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fQ:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/4
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
MD5 76fd02b48297edb28940bdfa3fa1c48a
SHA1 bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA512 28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0
SSDEEP 192:nx+uPBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads