Malware Analysis Report

2024-11-13 14:28

Sample ID 240603-llakzabe72
Target 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2
SHA256 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2
Tags
persistence spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2

Threat Level: Shows suspicious behavior

The file 12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2 was found to be: Shows suspicious behavior.

Malicious Activity Summary

persistence spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 09:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 09:36

Reported

2024-06-03 09:39

Platform

win7-20240221-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" C:\Windows\svhost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svhost.exe C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe N/A
File created C:\Windows\svhost.exe C:\Windows\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\svhost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe

"C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"

C:\Windows\svhost.exe

"C:\Windows\svhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 app.csvhost.info udp

Files

C:\Windows\svhost.exe

MD5 76fd02b48297edb28940bdfa3fa1c48a
SHA1 bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA256 07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA512 28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

C:\Users\Admin\AppData\Local\Temp\blndNw9FyRk93yf.exe

MD5 b2c22c3a80071c4f2812cb6a539d1249
SHA1 fe23298a01fce8da76fed5d234aa7343ff1d7b83
SHA256 3c76c274baaf8780eda08f23e1c6a0e7fe17245c1f6bf5f7b8ed37c0a33b0990
SHA512 dcc4d38a96095604e7f5b0ddc9ab6a8bb219ffc5636bc83a416fab59fd4d6612624d3f8c653da4271b3486641446eb9ef9e8a782ab7dab8f871589692f77784a

C:\Users\Admin\AppData\Local\Temp\blndNw9FyRk93yf.exe

MD5 996e1594d08809abfa3a5f9bb37a350b
SHA1 b89ce3b098efa47c5f5c6b73aebef14f3a7c6f2c
SHA256 ed61027bbd29bfd30e911c233a1b1b41f26d2e609d19ea33dfb3ad9cbd52cd48
SHA512 f9aa0479792b46927b71330a1185c9257ce4ca99ae627f38c3705f8f15caaea4705a19fdc4f8776a93f924a5a080e4ce2f07c8edfb4c319c43eb47b7e7659faf

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 09:36

Reported

2024-06-03 09:39

Platform

win10v2004-20240508-en

Max time kernel

133s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" C:\Windows\svhost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\svhost.exe C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe N/A
File created C:\Windows\svhost.exe C:\Windows\svhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\svhost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe

"C:\Users\Admin\AppData\Local\Temp\12a849f76149daecc14e8f00ceb0d40beb98fea18387a4b9e1512fb7837066b2.exe"

C:\Windows\svhost.exe

"C:\Windows\svhost.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 app.csvhost.info udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 21.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.173.79.40.in-addr.arpa udp

Files

C:\Windows\svhost.exe

MD5 76fd02b48297edb28940bdfa3fa1c48a
SHA1 bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA256 07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA512 28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

MD5 bbe24692dcad2285aea0a46dc0703f19
SHA1 9d8103e0d837a13d39cbfb767ed95144d3e2f57d
SHA256 785cd8cea1625b3397bfd9bc6d1e273302125cc0abefc69ddf1777e15ed0fafd
SHA512 daa0e208e7f3879cea296265545376d54f29e64dc3132391c6ee0f820490d00227aba0ff773966d4b6802e30cef1ff8371e9c68e11dd43a8d53b87e170649d9a

C:\Users\Admin\AppData\Local\Temp\M4ubijsLqEbFso0.exe

MD5 d3da8efce89e9311a03c2cf68d96f277
SHA1 7a95f3dae012d9e06da67c71e19ea3461ac567ec
SHA256 cb987dec7eeb756ed88ea9d0a55f0cf6db23d93e957f0f540719b9cb4938157d
SHA512 744487026665e66992cf168eb0fd50849cc88c25ddd300e95ae8f016cc8ca9521634e7a66c44b3838df7d894b4bb6cb2c7c2552e3724afbbb8ceaf830d65a3ee