243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe
Size 17KB
Sample240612-3nrqpsygrj
SHA256 243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6
MD5 47973e9534e1ba64847fe67032db681c
SHA1 c0f456346fca572da8e084b3b8e73de232e26302
SHA512 5ab1269a88b76b94185f8f38d7bc4e2b5574f2c21403744d6e0d87b2a66bd7d2f15683770363b883c31d4bc6fd8bfd429b421544ef4ab1e681ffc1106991b287
SSDEEP 384:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/6GS:ljjAQ+BzWPEwnE+KHM2/6v
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4296	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe
Token: SeDebugPrivilege	4296	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4296	1416	243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe	81
PID 1416 wrote to memory of 4296	1416	243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe	81
PID 1416 wrote to memory of 4296	1416	243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe	81

C:\Users\Admin\AppData\Local\Temp\243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe
"C:\Users\Admin\AppData\Local\Temp\243f97ad613b038577fa0be3bba454d21f3e0003ae7980d6234bb666c23c2ce6.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 339KB
SHA256 b358949c9d9d55b92358a97bdb4c4440deb1ad6fe651037fca2d703af21d594c
MD5 69c7c299b686953a90d5b1d9cade65ac
SHA1 932d0a4c0e9cc6eeba9c63d6d8a0bb60ee4791b3
SHA512 05b7958f1f7b6006f1b50fb5c4048f4f44dc5ec90f662bd5c77c2eecbb49e2db4f9e9ba70f44450b28451fe0e6bd288ac9961d564b9d385b225d468818e7ac14
SSDEEP 6144:9jhw+7YIvQRT0lxUVUkPzM3il5IADFWtzbhhZzNj30TvYAh3OU9KVTo:6IxUPM3ilS4MzlXzNjKYAZv8VTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

aq1uIfVamNUNnf4.exe

Path C:\Users\Admin\AppData\Local\Temp\aq1uIfVamNUNnf4.exe
Size 17KB
SHA256 da8285b00d2be8328f0d7e7065bfc98df324a5576bf010b474ba18994d809e6e
MD5 327b1aa66cd5d2918b8751bf894b667e
SHA1 03f7a1f181c417d370a8ba2516ed62645dfe10a4
SHA512 219ce91b820a52e1d615b2a910d1da05c6f730730a947830055d3b88d2e91a0c51c6602d09daee10db3b672af0432db6d31b1e70b587629b317b9b5dfb566ba0
SSDEEP 384:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/HNHJ2:ljjAQ+BzWPEwnE+KHM2/tp2
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8
MD5 5e7c375139b7453abd0b91a8a220f8e5
SHA1 88a3d645fab0f4129c1e485c90b593ab60e469ae
SHA512 0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2
SSDEEP 192:WWj5dBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads