a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6

General

Target

a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
Size

7.3MB
MD5

756ce7c48985fe7386352bcd910c73b7
SHA1

d0a0d6dc4154ee08dc64a648fef8cce24e608bb7
SHA256

a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6
SHA512

4cf68e3099d7c83f06cd90f8d70c1e7fc4e1f0562a52529f4a9d385b428fe0b23bc4d3701929889a051b7efe98760831779a049d77f931cf21d18954635d7036
SSDEEP

196608:Wq5u5mWON2TaLRhyGQe2QKpwMBHMKasCllV1K6:dWpTCR8GyC6Hzq1t

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3000	8Mz148k2uXxGVyk.exe
3036	svhost.exe

Loads dropped DLL 2 IoCs

pid	Process
592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
Token: SeDebugPrivilege	3036	svhost.exe
Token: SeDebugPrivilege	3000	8Mz148k2uXxGVyk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 3000	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	29
PID 592 wrote to memory of 3000	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	29
PID 592 wrote to memory of 3000	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	29
PID 592 wrote to memory of 3000	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	29
PID 592 wrote to memory of 3036	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	30
PID 592 wrote to memory of 3036	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	30
PID 592 wrote to memory of 3036	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	30
PID 592 wrote to memory of 3036	592	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	30

C:\Users\Admin\AppData\Local\Temp\a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
"C:\Users\Admin\AppData\Local\Temp\a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592
- C:\Users\Admin\AppData\Local\Temp\8Mz148k2uXxGVyk.exe
  C:\Users\Admin\AppData\Local\Temp\8Mz148k2uXxGVyk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3000
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8Mz148k2uXxGVyk.exe

Filesize
7.3MB

MD5
dd6b75a77601d62ac66df1b0a51a7de3

SHA1
699fc35deccb0cd6e341420903fc993535c2c98f

SHA256
2f46a1d48e1589e0aa10f215e77cb48fb90c531e19aa3c05d766f59b449f3c15

SHA512
43bd57e5379c22494aade734a45a443722327d48c7f06aa521048c99adba576e29bd70bba7bd28ba94f8f24f88efed7b8e5a1b3249cbfcb4d95fd0bc1f424d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.backup

Filesize
809B

MD5
8b6737800745d3b99886d013b3392ac3

SHA1
bb94da3f294922d9e8d31879f2d145586a182e19

SHA256
86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

SHA512
654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
4KB

MD5
4d89c6cffb30e7f4bec13cbc04fc1525

SHA1
371a0ff2bab28337da471ab7f2c400f88e2ed97f

SHA256
741f7bcbc55642505f2fc44b72e375e6a5f7f5daaefdc2a100b31bc394d30127

SHA512
aa099ce13b96e5fc92d62e270dd1926fb141b1cdc3d99b6de467eaf82c7e49dab64f8d0ddd57ac11b053775fb31ead77f4260923f969fa6ea3349058bbc736ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe.ignore

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit
memory/3000-14-0x000007FEF5743000-0x000007FEF5744000-memory.dmp

Filesize
4KB

Download
memory/3000-15-0x00000000008E0000-0x0000000001026000-memory.dmp

Filesize
7.3MB

Download
memory/3000-16-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download
memory/3000-24-0x000000001BEF0000-0x000000001C1D2000-memory.dmp

Filesize
2.9MB

Download
memory/3000-150-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads