5a8a7b9d70bb4b35c5518dfd8c7a37d07979675ee30d68365b4a8ddab13ebf9d

General

Target

123.exe
Size

1.2MB
MD5

9699ece4aac1cd1af577cdc06f514d52
SHA1

9809b61a6474ea3336e8ce0156195c55b7e05288
SHA256

5a8a7b9d70bb4b35c5518dfd8c7a37d07979675ee30d68365b4a8ddab13ebf9d
SHA512

c7ad3555e9eb233b616146a2e1d324093e076d07cccbe2d0bb3b769109e25bd2b720f2d494890b0bcf14047b8d23b6d194491d8e158b228cc7f4b6a1dc1b90ea
SSDEEP

24576:GAHnh+eWsN3skA4RV1Hom2KXMmHanp9t8FwcqBy46Ne6CBbh5:hh+ZkldoPK8Yanp/ckByxNxC1

Score

9^/10

credential_access discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2652	schtasks.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
2856	name.exe

Loads dropped DLL 2 IoCs

pid	Process
3056	123.exe
2652	schtasks.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000016d8a-14.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 2788	2856	name.exe	31
PID 2788 set thread context of 1208	2788	svchost.exe	21
PID 2788 set thread context of 2652	2788	svchost.exe	33
PID 2652 set thread context of 1208	2652	schtasks.exe	21

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	name.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-3450744190-3404161390-554719085-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2788	svchost.exe
2652	schtasks.exe
2652	schtasks.exe
2652	schtasks.exe
2652	schtasks.exe
2652	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1208	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2856	name.exe
2788	svchost.exe
1208	Explorer.EXE
1208	Explorer.EXE
2652	schtasks.exe
2652	schtasks.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3056	123.exe
3056	123.exe
2856	name.exe
2856	name.exe
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3056	123.exe
3056	123.exe
2856	name.exe
2856	name.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2856	3056	123.exe	30
PID 3056 wrote to memory of 2856	3056	123.exe	30
PID 3056 wrote to memory of 2856	3056	123.exe	30
PID 3056 wrote to memory of 2856	3056	123.exe	30
PID 2856 wrote to memory of 2788	2856	name.exe	31
PID 2856 wrote to memory of 2788	2856	name.exe	31
PID 2856 wrote to memory of 2788	2856	name.exe	31
PID 2856 wrote to memory of 2788	2856	name.exe	31
PID 2856 wrote to memory of 2788	2856	name.exe	31
PID 1208 wrote to memory of 2652	1208	Explorer.EXE	33
PID 1208 wrote to memory of 2652	1208	Explorer.EXE	33
PID 1208 wrote to memory of 2652	1208	Explorer.EXE	33
PID 1208 wrote to memory of 2652	1208	Explorer.EXE	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\123.exe
  "C:\Users\Admin\AppData\Local\Temp\123.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\123.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2788
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe"
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dews

Filesize
28KB

MD5
f5f9c8e83f2adc59d185bf00ee5dbe50

SHA1
f41ba8155ec3e1052bd8d5d1dbdcdc44de4767bc

SHA256
4860f068f6d1d120d39085d035e48b4c17398b2474c3a37a8a3688c3199798c2

SHA512
a128b8af1cc8750c20b134521d386fcbf51185ea6ef25c1568b0d514a4f0dbfb17d6ed903461534cb220607df7930ade82708a53d462f74da3907a57572b8b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\retrofits

Filesize
265KB

MD5
2bc90cf013e46a426eff53c3ff7832e5

SHA1
cd42a9d6338305c7bdf06db081a2e8f93ba4ffec

SHA256
33944926f3b414b6bf5f7f9516c669428fdcc51c2e2de560ce08107a48f4d7d4

SHA512
f66c3bc24f9f0efd4179d378c3b2cb8567cd164b646c6f749fdc05ffc0108f49176b73088ca163c55c65d8ebccb69074e2a8b89944d5b1dc31af635d8c6e5884

Download Submit
C:\Users\Admin\AppData\Local\Temp\x8i4ptj.zip

Filesize
557KB

MD5
d113a47c6ac162a76d78c817aeb57755

SHA1
f301cea25c2032dd67ffbd21242b209f0ee70ee2

SHA256
bae32df8fa24a3e55bcc1591e09918259173f870090e2ae775509edb8b893eb4

SHA512
ba64e248ee75fa43cae60c1e0815c512f89eabc140b35aa696d428a3f5d328db04981c0f500b78211bbfd9087ba678328c8ad63ac51249062900693a1d399178

Download Submit
\Users\Admin\AppData\Local\Temp\sqlite3.dll

Filesize
1.1MB

MD5
f55e5766477de5997da50f12c9c74c91

SHA1
4dc98900a887be95411f07b9e597c57bdc7dbab3

SHA256
90be88984ee60864256378c952d44b13d55ac032ab6a7b8c698885176bcece69

SHA512
983417a297e68b58fbd1c07fed7a1697d249110a2c10644b2dc96e3facedd3fbfbcac6a7809631ffd62894f02cadd4d3e62022b9e5e026e5bf434f1eb1878f05

Download Submit
\Users\Admin\AppData\Local\directory\name.exe

Filesize
1.2MB

MD5
9699ece4aac1cd1af577cdc06f514d52

SHA1
9809b61a6474ea3336e8ce0156195c55b7e05288

SHA256
5a8a7b9d70bb4b35c5518dfd8c7a37d07979675ee30d68365b4a8ddab13ebf9d

SHA512
c7ad3555e9eb233b616146a2e1d324093e076d07cccbe2d0bb3b769109e25bd2b720f2d494890b0bcf14047b8d23b6d194491d8e158b228cc7f4b6a1dc1b90ea

Download Submit
memory/1208-40-0x0000000009BA0000-0x000000000BF69000-memory.dmp

Filesize
35.8MB

Download
memory/1208-49-0x0000000009BA0000-0x000000000BF69000-memory.dmp

Filesize
35.8MB

Download
memory/1208-48-0x0000000005110000-0x0000000005203000-memory.dmp

Filesize
972KB

Download
memory/2652-42-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2652-45-0x0000000001F10000-0x0000000002213000-memory.dmp

Filesize
3.0MB

Download
memory/2652-86-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2652-41-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2652-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2652-47-0x00000000022C0000-0x000000000235F000-memory.dmp

Filesize
636KB

Download
memory/2652-46-0x00000000000C0000-0x00000000000FF000-memory.dmp

Filesize
252KB

Download
memory/2788-37-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2788-43-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2788-44-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/2788-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2788-35-0x0000000000720000-0x0000000000A23000-memory.dmp

Filesize
3.0MB

Download
memory/2788-34-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2788-39-0x00000000001E0000-0x0000000000200000-memory.dmp

Filesize
128KB

Download
memory/2788-38-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3056-12-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing