1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3

General

Target

1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe
Size

80KB
MD5

ef26e169018e94c57444e6634973bb09
SHA1

48c21d0822b6d1f407146b83c17f6bc676ab2a24
SHA256

1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3
SHA512

e58af650caa22c2066a5a8c4d427967c4fe8361558412642c0cc8da2c38ce6cdde0066ceaefae740b3877530b29830dc4d3dbf63a34afdf93655a3bf5e45c938
SSDEEP

1536:t3x85+Ks2KapmaE4dbfhc4dv92eZVMTtbmDfSIcOmXU9Nuuc1:th85+KsMpfd1ddMTtqSJXU9wuc1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1200	28dnIz2nKxIa2FN.exe
2844	svhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe
2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe
Token: SeDebugPrivilege	2844	svhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1200	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	28
PID 2232 wrote to memory of 1200	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	28
PID 2232 wrote to memory of 1200	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	28
PID 2232 wrote to memory of 1200	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	28
PID 2232 wrote to memory of 2844	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	29
PID 2232 wrote to memory of 2844	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	29
PID 2232 wrote to memory of 2844	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	29
PID 2232 wrote to memory of 2844	2232	1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe	29

C:\Users\Admin\AppData\Local\Temp\1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe
"C:\Users\Admin\AppData\Local\Temp\1581f024f05cc7e3abecef510aa13a9e13d9f6703eda9ef40d2241dcf749a9f3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\28dnIz2nKxIa2FN.exe
  C:\Users\Admin\AppData\Local\Temp\28dnIz2nKxIa2FN.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\28dnIz2nKxIa2FN.exe

Filesize
80KB

MD5
6b1c828444c8e04713d322238bcdd8ec

SHA1
db264e6c27089520720bb79ca96dfd6c246fc6cc

SHA256
28836f97ac1607165db363a5a0721a3a819a91ded9f40a2aa6a17944130f7809

SHA512
b4a9df5c003020455ad1507eb53bbfd3c5818f98186692982d7c3dc0ccf47c9000d61c55e2e8e237b1bbbc3c28bd91a9370f66c6f4c37950a1e84b6d2c2d8f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\28dnIz2nKxIa2FN.exe

Filesize
64KB

MD5
e97c622b03fb2a2598bf019fbbe29f2c

SHA1
32698bd1d3a0ff6cf441770d1b2b816285068d19

SHA256
5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160

SHA512
db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d

Download Submit
C:\Users\Admin\AppData\Local\Temp\706461028\zmstage.exe

Filesize
5.4MB

MD5
556064bd1529697355c2f3b2bcb1dc2a

SHA1
448cce58ebc4b9674d74d6ad0218019b14ab9577

SHA256
d40ca74be05bf61d68f418d3960a4d71445f70b2206fc19e94051d28dbe96f42

SHA512
73825d0af0dc4d8d799bd09307655da5a31250ea50d41131a8b81028c4768bf40e63905e7c628b5c57177dee4646f6dbdf1a5fc80df2648c6c9fe896a91696a3

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads