a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
Size

7.3MB
MD5

756ce7c48985fe7386352bcd910c73b7
SHA1

d0a0d6dc4154ee08dc64a648fef8cce24e608bb7
SHA256

a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6
SHA512

4cf68e3099d7c83f06cd90f8d70c1e7fc4e1f0562a52529f4a9d385b428fe0b23bc4d3701929889a051b7efe98760831779a049d77f931cf21d18954635d7036
SSDEEP

196608:Wq5u5mWON2TaLRhyGQe2QKpwMBHMKasCllV1K6:dWpTCR8GyC6Hzq1t

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2700	QNhJ6zfvgikUVQ2.exe
3880	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe"	svhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
File created	C:\Windows\svhost.exe	svhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
Token: SeDebugPrivilege	3880	svhost.exe
Token: SeDebugPrivilege	2700	QNhJ6zfvgikUVQ2.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2700	1908	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	85
PID 1908 wrote to memory of 2700	1908	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	85
PID 1908 wrote to memory of 3880	1908	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	87
PID 1908 wrote to memory of 3880	1908	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	87
PID 1908 wrote to memory of 3880	1908	a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe	87

C:\Users\Admin\AppData\Local\Temp\a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe
"C:\Users\Admin\AppData\Local\Temp\a4049b088737d808609ff7c4a823b6733289c40df42651b56e0837ca47fed2f6.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\QNhJ6zfvgikUVQ2.exe
  C:\Users\Admin\AppData\Local\Temp\QNhJ6zfvgikUVQ2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\svhost.exe
  "C:\Windows\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
338KB

MD5
83b80365569de66d0a0a22c22674467d

SHA1
18965f394869c7f704a9d7734cc142fc1f2e515c

SHA256
5063fbf1f1787979ccd7ad6eefea5db1db457fc60dbce791113c6064442fcea7

SHA512
ce7a00cda42cbf304c0acb2a7d18cb41eb614d83a3a3025bc45016f86b8cea3de84ca0b098116b7b9543a1fa852b4d60b102f88e725999b73a5bda221ef30e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\QNhJ6zfvgikUVQ2.exe

Filesize
7.3MB

MD5
dd6b75a77601d62ac66df1b0a51a7de3

SHA1
699fc35deccb0cd6e341420903fc993535c2c98f

SHA256
2f46a1d48e1589e0aa10f215e77cb48fb90c531e19aa3c05d766f59b449f3c15

SHA512
43bd57e5379c22494aade734a45a443722327d48c7f06aa521048c99adba576e29bd70bba7bd28ba94f8f24f88efed7b8e5a1b3249cbfcb4d95fd0bc1f424d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.2700.update

Filesize
9KB

MD5
14ffcf07375b3952bd3f2fe52bb63c14

SHA1
ab2eadde4c614eb8f1f2cae09d989c5746796166

SHA256
6ccfdb5979e715d12e597b47e1d56db94cf6d3a105b94c6e5f4dd8bab28ef5ed

SHA512
14a32151f7f7c45971b4c1adfb61f6af5136b1db93b50d00c6e1e3171e25b19749817b4e916d023ee1822caee64961911103087ca516cf6a0eafce1d17641fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\config\chocolatey.config.backup

Filesize
809B

MD5
8b6737800745d3b99886d013b3392ac3

SHA1
bb94da3f294922d9e8d31879f2d145586a182e19

SHA256
86f10504ca147d13a157944f926141fe164a89fa8a71847458bda7102abb6594

SHA512
654dda9b645b4900ac6e5bb226494921194dab7de71d75806f645d9b94ed820055914073ef9a5407e468089c0b2ee4d021f03c2ea61e73889b553895e79713df

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
4KB

MD5
ef9ba22334da77d44ec55fd4bcb08f77

SHA1
d4d71889a8ddb7dc6e063a7780c281ef413cc28c

SHA256
d0b5f9735ecbfcaea8638af193f2156a3ecb60460a7964107208bdc409d2fb33

SHA512
8771355d077fc04b87a6811cc5d2ccc5743d6637c81c8d4818c74d186cee3d405e34f9f90c570a8f26737ab650049b28800eb71bf0e6ff5e95f2ed1da5d5bcf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
805B

MD5
ce9f50c9004ca17f799b0144794a8d1a

SHA1
83f5786dab4f7cacf8140f14ff5eda7bae917af2

SHA256
56ea6680241c40f6a7cc64cec3c59f64dcb71861d0d21aed76745a5a693d9e02

SHA512
911ce3ce64b933edbcdead956051db43cde02b72ba9419a90b6df987a50d650b2a35ebf618acacffa5eb879c6f817e6c79653c414616b22ea433c945714625ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\chocolatey.log

Filesize
2KB

MD5
707b6ad9a8f451f914ed1379445bf501

SHA1
db75fe5cc52f3cb698ccd522a9b24997e017b1a2

SHA256
5e4a9131ac43ad91c7fde12a4563c95dcdef1ebddb25b73903c00d5b3168720f

SHA512
9e6f331ed7610edbb4f595a20c0b60e97c1aaffbd5340072fa6518ee7118843a1c8c243e4aed8aa33f00d486439a09d2363815e3cccd472061186f7c5febddaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\redirects\cpush.exe.ignore

Filesize
2B

MD5
81051bcc2cf1bedf378224b0a93e2877

SHA1
ba8ab5a0280b953aa97435ff8946cbcbb2755a27

SHA256
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

SHA512
1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

Download Submit
C:\Windows\svhost.exe

Filesize
16KB

MD5
76fd02b48297edb28940bdfa3fa1c48a

SHA1
bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

SHA256
07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

SHA512
28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0

Download Submit
memory/2700-38-0x000000001BF90000-0x000000001BFB0000-memory.dmp

Filesize
128KB

Download
memory/2700-27-0x00007FFAB9B10000-0x00007FFABA5D1000-memory.dmp

Filesize
10.8MB

Download
memory/2700-63-0x000000001E110000-0x000000001E160000-memory.dmp

Filesize
320KB

Download
memory/2700-64-0x000000001E1E0000-0x000000001E256000-memory.dmp

Filesize
472KB

Download
memory/2700-65-0x000000001E0C0000-0x000000001E0DE000-memory.dmp

Filesize
120KB

Download
memory/2700-26-0x0000000000CB0000-0x00000000013F6000-memory.dmp

Filesize
7.3MB

Download
memory/2700-21-0x00007FFAB9B13000-0x00007FFAB9B15000-memory.dmp

Filesize
8KB

Download
memory/2700-170-0x00007FFAB9B10000-0x00007FFABA5D1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads