b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe
Size

22KB
MD5

942525f6d3b2c54d6b7860748f3feaca
SHA1

115a4b6913268e91e8e85162076b89ea4b794c1f
SHA256

b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb
SHA512

0a6391fb8be0bddc179c09e50925f54ab5034d8f73922045858ad6bfb38a33e2acfacd8ce7edfdeb6c004b7c191ba06e8ee1e5e01e006f598e7d1fa00821ef3c
SSDEEP

384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/nlhMdgW0613c:IMAQ+BzWPEwnE+KHM2/nlhMdiUs

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2452	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe
Token: SeDebugPrivilege	2452	svhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2452	800	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe	30
PID 800 wrote to memory of 2452	800	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe	30
PID 800 wrote to memory of 2452	800	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe	30
PID 800 wrote to memory of 2452	800	b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe	30

C:\Users\Admin\AppData\Local\Temp\b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe
"C:\Users\Admin\AppData\Local\Temp\b887f573665bfeaa9a96f0d89ebbfb14d93daf62f45515eaa6e04bde8cdd3bbb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0LsyNtFLKlIACRQ.exe

Filesize
22KB

MD5
2042ec9b72f2ffa18d710124e1800432

SHA1
101b2262fd546674275b36497816657d25c76abf

SHA256
1adfce874218bd813dad152a010704de8657722b8d8a978baa5abf81bb50ed1f

SHA512
b66c14be3d1cb1575cf8e48fb4b37882d3c630aa1041e3a964f82d0e14dd7ef7338300ef66ebb97d4460f4162d2117240ad504070b8628a91fdf57e4c40ecea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\3976194126\zmstage.exe

Filesize
5.4MB

MD5
7f64a2ef58ce751b474d0dcaeb8d5ee4

SHA1
00d82019e86917933eb6c3e74addb4e757d3708e

SHA256
f0f9ca9c415567793dea1428bb057b27cf1b4c2c9b210ece6afa182f2a5b16cb

SHA512
cdb35455ee66e8c83e2eabbc23bc3cca8fc4ca5a3c8a8c62ed995e14cfdb3e301bff96996cd9912cbb49f43513e9b6d0793228e8d3024fa794f80eca063ada10

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads