f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6

General

Target

f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe
Size

210KB
MD5

4d397884b99b9446cbdef1f239267fe5
SHA1

7c8d75be3adc65b67566711ee28711473f55a3cb
SHA256

f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6
SHA512

9fdcf20c7717628d880f79eca019b39e4f992b1b544d656906eef46a8e4a762925040751a8ba75597c4521520a5bc72833157b0b05d7cef3c168fa5b0748e4d8
SSDEEP

3072:IiU7bCBgZgeeHvqQdmZ/cJBA19bSPv6yna2exm15/QS1sSoYmAhJhbA6e62:IVUFeeHyQ2fsCqPexm154S1eSrreP

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-2-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2400-5-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2400-6-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2508-14-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2508-78-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2204-80-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2204-83-0x0000000000400000-0x000000000044E000-memory.dmp	upx
behavioral1/memory/2508-126-0x0000000000400000-0x000000000044E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2400	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	30
PID 2508 wrote to memory of 2400	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	30
PID 2508 wrote to memory of 2400	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	30
PID 2508 wrote to memory of 2400	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	30
PID 2508 wrote to memory of 2204	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	32
PID 2508 wrote to memory of 2204	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	32
PID 2508 wrote to memory of 2204	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	32
PID 2508 wrote to memory of 2204	2508	f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe	32

C:\Users\Admin\AppData\Local\Temp\f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe
"C:\Users\Admin\AppData\Local\Temp\f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe
  C:\Users\Admin\AppData\Local\Temp\f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe
  C:\Users\Admin\AppData\Local\Temp\f07f5b9c0656dc035149bee4ac1781fa2f014e258200979cbb7bee763ef93da6.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\D86A.53F

Filesize
600B

MD5
d9c1ac8f9b11f4be11e73b1544dd875e

SHA1
be6a4d5772c26ac02f6ac647674a825a56c7ed57

SHA256
49d43774be95bd74c001e489a04174cac469fc680d6c63bfcb2174eb82795926

SHA512
4837f044ed4e3063db591b224bbd6f02772c6bd6506b6e6f566971468111a4e3fe377a4320d85606beb2954e1db683057189c4a8346aa71e780a5c44da24449e

Download Submit
C:\Users\Admin\AppData\Roaming\D86A.53F

Filesize
996B

MD5
9c7ac99cbf93868c16cfaefc851b0a90

SHA1
0ac2dfda123e5dec9ca4739421e8cc120259dc50

SHA256
92b1adaae11c7776bf9aedb5d9ad026e154ffee292325b776cdf328f8d28e71e

SHA512
224f564f5944b9d27dbcd2ce13176143bce43c01071dae681776b7c04f85a9798a6fd98607a00476d36709fe716d14d9448a72668edf532d42fa274a07769ffa

Download Submit
C:\Users\Admin\AppData\Roaming\D86A.53F

Filesize
1KB

MD5
b195b55f9443777b42972b56fd3dc42a

SHA1
cbec93b6919ca6bb479aa1282fac1ae48e615040

SHA256
2f4dd6d163bfc028bfb126d1453e2640fbf2899df0a64a683d4df2653ef84ec6

SHA512
62a2d7edddcb15bbf30ffa7e35e457e6a062b206ccc17b6754ed5a63ce8f0cf636acbd7ad31e52696aa0cd86a00726c5aff7d28efa11bfd25c0ddcf3bb8214c8

Download Submit
memory/2204-80-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2204-83-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2400-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2400-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-2-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-78-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2508-126-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing