1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5

Analysis

max time kernel
52s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe
Size 17KB
Sample240613-yllz8ayfpb
SHA256 1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5
MD5 2f4029d256e45df277774e3acecbdb69
SHA1 9ce61809bc0344465ecf5157dd22c525088687c0
SHA512 ecc583d010cf12911c748f5aabac42e7c0bab645f026876f2a15d74a1740fe6d9b134e7404d7a7d230ac8a0baada49ab53c4149846b74447be6b1243a2686487
SSDEEP 192:WWj5dBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/f2:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/O
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4836	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe
Token: SeDebugPrivilege	4836	svhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 4836	1784	1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe	82
PID 1784 wrote to memory of 4836	1784	1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe	82
PID 1784 wrote to memory of 4836	1784	1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe	82

C:\Users\Admin\AppData\Local\Temp\1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe
"C:\Users\Admin\AppData\Local\Temp\1285af661944e8816e40d11368e5d83b3fbb836bf474daa1ce345f328b1e44c5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

excel.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Size 339KB
SHA256 bb95163862899eb895af9f8f18209cee0915139736a9c2872d7673b2112fbe81
MD5 90ca942a33a087f64f5c50dd127ab528
SHA1 48aa772c6da07eba842ec11289ae86d4595238e6
SHA512 768c9afb0a8841a14087303210420ea8dd8fec3fc5d7606fd0ddf2c56549e2b8933271c91e41aa58b2066bbd6aa32eee6b10fdbfea5a8d7d43057858145d89f8
SSDEEP 6144:9jhw+7eNzTXNIKo9StIsbvw4tDtUuBCwXv6TaMcXMumvdpVAovA82hABmK:eJTXNI/eIsbZ5B3v6OMcXTmnGx81BmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

lBszN988ZmMKIhZ.exe

Path C:\Users\Admin\AppData\Local\Temp\lBszN988ZmMKIhZ.exe
Size 17KB
SHA256 a3c7d55f09ae77718a25399eee02ad7bda3aeb13c1b4d8498ce48aa9826a9844
MD5 775aa8e3b508663721764ec497fed775
SHA1 c665f924824dc5bfbf38a48dc435ca2b56a2a7ba
SHA512 b27b6bbc23e8efe85c2b949c24d779fa3b3ad8e7600a1e541d443c014f0131085c8ea45eeb58e24ffee554870a751a1be6ada31534f156bb457e351db7870c02
SSDEEP 384:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/x3:ljjAQ+BzWPEwnE+KHM2/x3
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhost.exe

Path C:\Windows\svhost.exe
Size 16KB
SHA256 36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8
MD5 5e7c375139b7453abd0b91a8a220f8e5
SHA1 88a3d645fab0f4129c1e485c90b593ab60e469ae
SHA512 0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2
SSDEEP 192:WWj5dBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads