0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8

General

Target

0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe
Size

134KB
MD5

9a437de4ef00f395670628e3baa9df50
SHA1

0f7be408136c02ab30e65f20a86f817543d14f97
SHA256

0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8
SHA512

db4f619de8b6990a60a9db8dd9c74aed2a01bf0be79d6ae0d62ae4c24df0bcae31f3b8dd681a141ff12ab1d0bd70f5328989103920486e91855a692d3afc5336
SSDEEP

3072:iR/yGECL2aZwHj2saYDZSpiXL/0swl8scsNLPlVGdQIb3:e/cCL2aZwHXVDZxXL/4l5c8Ryb3

Score

10^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\shell.exe"	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-3-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1500-97-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1500-96-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/2224-95-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/1500-98-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/2224-99-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/2232-165-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/2232-166-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/2224-167-0x0000000000400000-0x0000000000476000-memory.dmp	upx
behavioral1/memory/2224-249-0x0000000000400000-0x0000000000476000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1500	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	32
PID 2224 wrote to memory of 1500	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	32
PID 2224 wrote to memory of 1500	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	32
PID 2224 wrote to memory of 1500	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	32
PID 2224 wrote to memory of 2232	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	33
PID 2224 wrote to memory of 2232	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	33
PID 2224 wrote to memory of 2232	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	33
PID 2224 wrote to memory of 2232	2224	0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe	33

C:\Users\Admin\AppData\Local\Temp\0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe
"C:\Users\Admin\AppData\Local\Temp\0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe"
1⤵
- Modifies WinLogon for persistence
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe
  C:\Users\Admin\AppData\Local\Temp\0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe startC:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe
  C:\Users\Admin\AppData\Local\Temp\0622ea76d4ec7989443630c6ea1c60c2236dab91f0e213e779524984cf16a4e8N.exe startC:\Users\Admin\AppData\Local\Temp\dwm.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
924B

MD5
4ef18129ad2a8995d69d0dce53eddf6c

SHA1
cb407de6d28775b61598687c9c51750355f755d6

SHA256
491529df4c868e1c880369e50bde201a30e82bdb7fe885c092369117195cd2f8

SHA512
98ba2d14f0cdcbce6caceee2d8dc21f85b69fcaef4389dda30e9c16316d323422baaec9b7d9700b79134e681f694d2df3a6b908f8060bbb0a19bd97a82f92cad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
612B

MD5
23152ae5f4d4cf868b87e87964088d7e

SHA1
823828facb3b3e79f209f28393fde4b45b64c6df

SHA256
8bb18317a94d0a2e08cb050804fdb1523a884d7c8c86061217e5d33fb027e41f

SHA512
4da5aa6b6ac73f296a7ae5a5581b6942944760cc4faab39eae174376f1bdf33886485de3011ba69748f5d525dd082f98e33d1b4122d4cb548a2fb3e340f2536d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
1KB

MD5
5377e8de43a1a27acb857f06d87a0419

SHA1
024d5a52abada214aaa3fe4146c555b776a273ea

SHA256
87ca6bbc968c0086d2a779800509457fa5c2204b3b3b93310f97d54b3235e09b

SHA512
295ab9d97d6df601a31a87819c1c555053629ff574a21e739057d679497d0fa1589fc3b8bb8fe2da42710935550fc949b17eaeb21a6148ac4a5b33022b11b8f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\stor.cfg

Filesize
1KB

MD5
c3afeac90b5856339bf657940f3b822b

SHA1
b5bbaa56978c9b8a61f916842fb421626a76b073

SHA256
4f7d65ae3c93cbdcde7d2c7abfb6c459b419e85f579165af6a47be3ecdbd426e

SHA512
02e8206297feda8b20b8a1d06f21cce1e94926b3c5b6e3195675e0d0d20cee35fa3dce59b583e0cb127d19d38e70d4a18bb0137a527fd5d20d28e4fad6c82092

Download Submit
memory/1500-98-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1500-96-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1500-97-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2224-95-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2224-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2224-99-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2224-167-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2224-3-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2224-249-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2232-165-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/2232-166-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads