ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe
Size 16KB
Sample240603-mrnkfsch88
SHA256 ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb
MD5 9e7ce58cdb36e8c68dba291459b308c5
SHA1 b002cb42c7dfc2c200428eb6f2701964e735c9d9
SHA512 ea275243d5f66033796a5544193d71c967a7801c86d9693daf10db2dd573f7786c4fbb791db9e383c5673b8934d8f4b85ad199ff68b3576192b1ecf6d12c9333
SSDEEP 192:WWj5dBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fM:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/k
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5108	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe
Token: SeDebugPrivilege	5108	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 5108	2564	ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe	85
PID 2564 wrote to memory of 5108	2564	ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe	85
PID 2564 wrote to memory of 5108	2564	ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe	85

C:\Users\Admin\AppData\Local\Temp\ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe
"C:\Users\Admin\AppData\Local\Temp\ea8d6d22b4c2c364adda3b256319b8c7ea8c6c1bbd9c04bd20fa6e528cda20cb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 339KB
SHA256 1c2a8f4a58fddbcc48e63757edd9e630f451a90b277d1193f6193f06aee08b32
MD5 297938d8ac1a21bca6cb7d32c6b6d631
SHA1 0edc7cd0d34172ed5a4ce6dff78f35c010cf8a70
SHA512 88fbadc67e59a8c23322a1bfd9977b778a4aae2c30b7ab3c4b6d6394ed00b459fa4e2758f98b7a77b866ea59efd8e8ed1cd905ea778b13ae2d98eb96d706132c
SSDEEP 6144:9jhw+7oedt64s8atqSeeQSWtIszTaoVmfsRqR4qxGFzHSsqlDubxNJWV+zlrkzvw:oCZs38tIs3RVy+qR4WG8siKbxNJWV+Br
MD5 SHA1 SHA512 SSDEEP

Submit Download

B2aB2F1vOK9XBAR.exe

Path C:\Users\Admin\AppData\Local\Temp\B2aB2F1vOK9XBAR.exe
Size 16KB
SHA256 fa4f2844671c54c2fc5facdbae1616bb074eaff178e5c6a781d9356286dc8e37
MD5 04798bb004ec30e8ddf3c667b6c91d13
SHA1 8dcd640b8969ab292cd8ef7932f3105f110f48d9
SHA512 eda174133b678e522fed8ea3bba91993a678041e65337fdf6e4feab2471e44010034dfc76385f2c5793dd999c23095d75c65bc6af3d000a1aae05fcd86a81283
SSDEEP 192:WWj5dBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fh:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8
MD5 5e7c375139b7453abd0b91a8a220f8e5
SHA1 88a3d645fab0f4129c1e485c90b593ab60e469ae
SHA512 0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2
SSDEEP 192:WWj5dBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads