95866136fa14c893534cf2f7f7c501fd1d9e55c25d04e1df73de802e2b2e0737

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1.exe
Size 5.5MB
Sample241107-agbfxs1dmg
SHA256 95866136fa14c893534cf2f7f7c501fd1d9e55c25d04e1df73de802e2b2e0737
MD5 aedfca520340f2165d7335719681d0b3
SHA1 5bca872c93d7f67f3a54869fceff57fab2b845be
SHA512 a51d8db203bf64c8e5f170bfc68ceb98997fbce5f4fb9ed2dce450df84853c8da824423b5a8a87f10ab4b3e38b54b6452d60ce5dab8993c38256b475843fdb50
SSDEEP 98304:+pPr4hlCyooFykRkW7ANPbiENcmcf1uoa+Jtxz4hIAznzDWQoJWoJVG6loKOLDk:+pToCyobM7ybtwG+hkhIA7HgJW221E
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

collection discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	1.exe

Executes dropped EXE 2 IoCs

pid	Process
2072	madHcCtrl.exe
2524	madHcCtrl.exe

Loads dropped DLL 9 IoCs

pid	Process
2072	madHcCtrl.exe
2072	madHcCtrl.exe
2072	madHcCtrl.exe
2072	madHcCtrl.exe
2524	madHcCtrl.exe
2524	madHcCtrl.exe
2524	madHcCtrl.exe
2524	madHcCtrl.exe
1556	rqCli.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rqCli.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 3636	2524	madHcCtrl.exe	95

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	madHcCtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	madHcCtrl.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2072	madHcCtrl.exe
2524	madHcCtrl.exe
2524	madHcCtrl.exe
3636	cmd.exe
3636	cmd.exe
1556	rqCli.exe
1556	rqCli.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2524	madHcCtrl.exe
3636	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	rqCli.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2072	5068	1.exe	86
PID 5068 wrote to memory of 2072	5068	1.exe	86
PID 5068 wrote to memory of 2072	5068	1.exe	86
PID 2072 wrote to memory of 2524	2072	madHcCtrl.exe	90
PID 2072 wrote to memory of 2524	2072	madHcCtrl.exe	90
PID 2072 wrote to memory of 2524	2072	madHcCtrl.exe	90
PID 2524 wrote to memory of 3636	2524	madHcCtrl.exe	95
PID 2524 wrote to memory of 3636	2524	madHcCtrl.exe	95
PID 2524 wrote to memory of 3636	2524	madHcCtrl.exe	95
PID 2524 wrote to memory of 3636	2524	madHcCtrl.exe	95
PID 3636 wrote to memory of 1556	3636	cmd.exe	109
PID 3636 wrote to memory of 1556	3636	cmd.exe	109
PID 3636 wrote to memory of 1556	3636	cmd.exe	109
PID 3636 wrote to memory of 1556	3636	cmd.exe	109

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	rqCli.exe

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\madHcCtrl.exe
  "C:\Users\Admin\AppData\Local\Temp\madHcCtrl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Roaming\apphttp\madHcCtrl.exe
    C:\Users\Admin\AppData\Roaming\apphttp\madHcCtrl.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\rqCli.exe
        
        C:\Users\Admin\AppData\Local\Temp\rqCli.exe
        5⤵
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        
        PID:1556

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bob

Path C:\Users\Admin\AppData\Local\Temp\bob
Size 4.4MB
SHA256 253c468d89426458d936829ff847a6add51f1f554e87e6edd4fecc61679eec0a
MD5 4c08d5b1ff462aec8c717fefb43a5d79
SHA1 b0631eb3f82f6685c6fd3125bdf1d402c81ebd9a
SHA512 08906bf6360a28e299d16cd59dab580c876e34ecb3e013d246433924e10c69dba316bf2941b8e2afadf380a916acd42b98492752a17c251e14c11f2ee532ceba
SSDEEP 98304:N69Rv4yVQIneGnN6eCXePBRTO4W1SMC+SAuQF:ONrZecsXeJRq405xShY
MD5 SHA1 SHA512 SSDEEP

Submit Download

c7f11b5d

Path C:\Users\Admin\AppData\Local\Temp\c7f11b5d
Size 5.5MB
SHA256 ed721d24008909a05ad3e01ddf77e9a3fee9b05160507767a4023764d665bf03
MD5 9a257042edc8bed776308f6a020e1f27
SHA1 1e3ebe9b49d34ab4e09b3b6519ab50bf9136a9a7
SHA512 b7715535fe4ca35f591cba89f7494584442abb637f7d00fec056ccecfb392b94c3fe5f5a0de1f7da6050184845c7408a9653c8537107f2b051d501ecf3d04011
SSDEEP 98304:w7CxOwUH7A7EqHPHgMhF/Ok9wyXB80M6GtX/XTDJCsntWe3c2VogN8:w7upCoB85/Tr9vo
MD5 SHA1 SHA512 SSDEEP

Submit Download

imon

Path C:\Users\Admin\AppData\Local\Temp\imon
Size 16KB
SHA256 4abd162388fb2926920e7bcf5b368dc4617e014ee23ead38c28ed397fa0b462c
MD5 a5f836076b39dd8e9cb1b96d95b1b9a9
SHA1 a7d5c4606f3717a08fd16994d495126863e9c894
SHA512 181b5cb318c07a0a7e326d75ba5a51bc9c4b1b7e2f20e726db21803574999aeec8ca15ee4e7bbe14b92598510ae7590584c306e1c66cb55a40390ad39c7b6ba8
SSDEEP 384:v0AO0UZXTR5aCLTKcRLmp3rSZmsA1Mpphg7PdWK:v0AOBtt1TLLmN6Zre7PUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

madHcCtrl.exe

Path C:\Users\Admin\AppData\Local\Temp\madHcCtrl.exe
Size 3.1MB
SHA256 69a90665113bd73b30360d87f7f6ed2c789a90a67f3b6e86474e21273a64f699
MD5 b841d408448f2a07f308ced1589e7673
SHA1 f5b5095c0ed69d42110df6d39810d12b1fa32a1e
SHA512 a689734048109ab7bec9491bbb7781686c19c7885166b3ca2975e2f49e956fcc388cd8ca85a4e5a8bf9efe6056f1e0d80197b7f521d4f0d4cadb10ba9ef1fa93
SSDEEP 49152:pvFg5qg9BtIAHE3SM4ahx6LK2SamuZob+tCjNrv8:Jm5qGBHBLRKuZfkjNrv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

madHcNet32.dll

Path C:\Users\Admin\AppData\Local\Temp\madHcNet32.dll
Size 921KB
SHA256 ce6ea9456b3e01b8190b88cc056334084d9b436f27aa7a0b9fba85a8c8cb1fd0
MD5 5b55894537ae8c608d78c2647bc38a95
SHA1 6ba21cbf15d7a07cabe11797e7e9876de9a65a60
SHA512 dd89827c3a16d0b5ee2351db1a848d8e3aefa42cfae160b686cecd7f8b4c903f4a85fa82784f5c14b428cc8958169e58b4cf58f661628858f69de97d5ae13a71
SSDEEP 24576:solUbWq3/gquYUJ4Vgv0eUnDaE0Pnxf2T9z:9UR4quYUJ4VgceXE0PxfK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mvrSettings32.dll

Path C:\Users\Admin\AppData\Local\Temp\mvrSettings32.dll
Size 1.0MB
SHA256 b7d3bc460a17e1b43c9ff09786e44ea4033710538bdb539400b55e5b80d0b338
MD5 d168f18b79f9f33690f011d1deb1e7cf
SHA1 cf0d984ce101ec274e65e88fae07daeb26de5a6d
SHA512 bbf085bcbc3c1c98caba95bdf48051bac18bbd1b7314c7bb55b56e3d423fb34758cc239c237091486cc466123bf02844eaac3b4435cb535af25dc2bca625af71
SSDEEP 12288:1wsE8YWuTCipwKm3ZCdX+y0Cg57ZrVmK5UhYX5NN/u3ZeEb+LJkguVl1Y1e:XIWuFKKVuig5jZ5xX5P2bKyguJf
MD5 SHA1 SHA512 SSDEEP

Submit Download

rqCli.exe

Path C:\Users\Admin\AppData\Local\Temp\rqCli.exe
Size 2.3MB
SHA256 b22bf1210b5fd173a210ebfa9092390aa0513c41e1914cbe161eb547f049ef91
MD5 967f4470627f823f4d7981e511c9824f
SHA1 416501b096df80ddc49f4144c3832cf2cadb9cb2
SHA512 8883ead428c9d4b415046de9f8398aa1f65ae81fe7945a840c822620e18f6f9930cce2e10acff3b5da8b9c817ade3dabc1de576cbd255087267f77341900a41c
SSDEEP 49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

unrar.dll

Path C:\Users\Admin\AppData\Local\Temp\unrar.dll
Size 304KB
SHA256 0891edb0cc1c0208af2e4bc65d6b5a7160642f89fd4b4dc321f79d2b5dfc2dcc
MD5 851c9e8ce9f94457cc36b66678f52494
SHA1 40abd38c4843ce33052916904c86df8aab1f1713
SHA512 cdf62a7f7bb7a6d511555c492932e9bcf18183c64d4107cd836de1741f41ac304bd6ed553fd868b442eaf5da33198e4900e670cd5ae180d534d2bd56b42d6664
SSDEEP 6144:e2Gk6wDaKov/5qrawOZI8uN0f/UVvN3MwdZFmiVFC+OEu:e2GkNo35qrawqmG/yM8PmiO+Ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1556-93-0x00007FF603F00000-0x00007FF6041F4000-memory.dmp

Download

memory/1556-88-0x00007FF603F00000-0x00007FF6041F4000-memory.dmp

Download

memory/1556-87-0x00007FF603F00000-0x00007FF6041F4000-memory.dmp

Download

memory/1556-82-0x00007FF603F00000-0x00007FF6041F4000-memory.dmp

Download

memory/1556-80-0x00007FF603F00000-0x00007FF6041F4000-memory.dmp

Download

memory/1556-79-0x00007FF603F00000-0x00007FF6041F4000-memory.dmp

Download

memory/2072-32-0x00000000730F0000-0x000000007326B000-memory.dmp

Download

memory/2072-42-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/2072-29-0x0000000000DC0000-0x0000000000ECB000-memory.dmp

Download

memory/2072-33-0x00007FFA32290000-0x00007FFA32485000-memory.dmp

Download

memory/2072-50-0x0000000000DC0000-0x0000000000ECB000-memory.dmp

Download

memory/2072-49-0x000000004A600000-0x000000004A6EC000-memory.dmp

Download

memory/2524-62-0x0000000000BA0000-0x0000000000CAB000-memory.dmp

Download

memory/2524-57-0x00007FFA32290000-0x00007FFA32485000-memory.dmp

Download

memory/2524-56-0x0000000074A20000-0x0000000074B9B000-memory.dmp

Download

memory/2524-63-0x0000000074A20000-0x0000000074B9B000-memory.dmp

Download

memory/2524-59-0x0000000074A20000-0x0000000074B9B000-memory.dmp

Download

memory/2524-61-0x000000004A600000-0x000000004A6EC000-memory.dmp

Download

memory/2524-53-0x0000000000BA0000-0x0000000000CAB000-memory.dmp

Download

memory/2524-60-0x0000000000400000-0x0000000000711000-memory.dmp

Download

memory/2524-58-0x0000000074A33000-0x0000000074A35000-memory.dmp

Download

memory/3636-69-0x00007FFA32290000-0x00007FFA32485000-memory.dmp

Download

memory/3636-72-0x0000000074A20000-0x0000000074B9B000-memory.dmp

Download