10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe
Size 17KB
Sample240613-ed1c4atbrc
SHA256 10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059
MD5 c88441282c3b2d71deda117e04541bf9
SHA1 40a095cf983e93728c0f7488b74d8d890edf653c
SHA512 566537fe34c19ea4c4d26e56ab6733059bbdfcc8ce9d4c89dbde3575a0b387f806281143d148e0e972f9ebbd8c5485b2cfb6e8437c1fe8f18422c4e12b495323
SSDEEP 384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2//w:IMAQ+BzWPEwnE+KHM2//w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3648	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe
Token: SeDebugPrivilege	3648	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3648	464	10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe	81
PID 464 wrote to memory of 3648	464	10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe	81
PID 464 wrote to memory of 3648	464	10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe	81

C:\Users\Admin\AppData\Local\Temp\10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe
"C:\Users\Admin\AppData\Local\Temp\10a7a1e45ea8dcbb9629b35cb4a397ed4652f24fbf5a927f83f3d33475a42059.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 339KB
SHA256 4966fbc8214da9007c09489c8a613102441eea7f9acbdd44c1997c2fc5d7f669
MD5 2471854be4ae2483d6bd625d07868e5a
SHA1 87b3576beb3f36e076a34cc25d180cd7b7e28fec
SHA512 a9f40909942f665cfcc89b1835364b978ffacbcd73540c4cbe98cd0ec7d90d18ee8fa90a852a4d6e415ff9a30f01e39f1fb9a5d70ad3840a79ecef48f75bd685
SSDEEP 6144:thw+73fxym+qvjDcjOp0jamXiaS+YSDamm9kcKNf4AqUb9ifSj5vpWod3LAfo4wf:rp+skj2WBXXsSeH6f4ybgfqGo4wf
MD5 SHA1 SHA512 SSDEEP

Submit Download

6w920oO1TrD5kk8.exe

Path C:\Users\Admin\AppData\Local\Temp\6w920oO1TrD5kk8.exe
Size 17KB
SHA256 819ac18719f574a090de9fc59cd1cdd235d8d18af1bfd1e430af2b233951daa3
MD5 9ac21d6349738e7a4f745ce940de78d3
SHA1 ba226bab544e5bfcd3d78cc42db4663622fd3746
SHA512 859eadca389912f151843c1d9afbf2610714a214a26230c7ea1ce8ddb2274cba058f59d4ae85c6291f6ba7308fa8e10183f7c872b4784e8e65a9fd78ec0fea58
SSDEEP 384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/mwJOQ:IMAQ+BzWPEwnE+KHM2/tZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
MD5 76fd02b48297edb28940bdfa3fa1c48a
SHA1 bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA512 28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0
SSDEEP 192:nx+uPBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads