ff9c2ad53217ff19274a9e34a74357102890857ce698a5c66c3cce2d0cc6cd23

General

Target

989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe
Size

3.1MB
MD5

7a16f2f0629a440695945db2a191c6a1
SHA1

067c54721377eeefd199acb37402308bdfe73b3b
SHA256

989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944
SHA512

6b698efd1ce0c5ecce64ab63146fc04d9086f70075fc89482e4141b69c8e31327e28618f0f37bc89eadf5ae7211b282beb9b786c9b61e5008405add527a81e0c
SSDEEP

49152:rvlat1Rsi9Zn31w7LsuPKdDeXid5506WGPmFaRa2M/S6vya7/fmzXt8g:e/ssn3QsaKJ9SasXv72zXt8g

Score

7^/10

credential_access execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4740	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4740	2656	989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe	84
PID 2656 wrote to memory of 4740	2656	989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe	84

C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe
"C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KXfhIg4y5nRnki6y8TdJHko4cKdz1w\sensfiles.zip

Filesize
3.9MB

MD5
36b5df67c4f78142d301036c1e73fa6a

SHA1
50af7ffea54d4f81cb2cb2b58376e8ae402ef52c

SHA256
6b3213278b1c45a6d4d2694fd0199126e32a6eaae045e21a9f353e94e316e8ba

SHA512
efd43092eb3b8fc8ed28ce3ea962717869171e41f9a843fa9cb48202593061809aa6baa41ec5c591645c1fe580ba200dc2f38ef5456452329b9a04c04d2d808d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a3gvzsd2.snc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\coccoc_default_login_data

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\qip surf_default_login_data

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\qip surf_default_webdata

Filesize
114KB

MD5
2ba42ee03f1c6909ca8a6575bd08257a

SHA1
88b18450a4d9cc88e5f27c8d11c0323f475d1ae6

SHA256
a14fb57193e6930fa9e410d9c55dfe98e3ae5e69b22356e621edc73683a581bd

SHA512
a1f32c22f0d78cba95c04c432e2a58ea47fb34942e70bfdceffcc2ac1e91b87a3da2cd9f93793427ee09a623c7da700e1c16977d41a44286317e8fc20502f035

Download Submit
C:\Users\Admin\AppData\Local\Temp\qip surf_network_cookies

Filesize
20KB

MD5
6613f60764c90a868f6c7f70a66f9d55

SHA1
9f1f15f0e9de0feaba1117928868e8cc7377afdc

SHA256
1db1bc276625c56d0b9290ec3841f4adc92aec575912e1a172b773ca38e4d071

SHA512
809b3aa5aba65947abb9090a23731544abf38e8c89b70dee417d9bf2e4997e8559ade387f1ecd78e54568fba48ff20af3983ab76d9f3706d30b3eeca802a0fe2

Download Submit
memory/4740-0-0x00007FFA03A43000-0x00007FFA03A45000-memory.dmp

Filesize
8KB

Download
memory/4740-1-0x000001E553010000-0x000001E553032000-memory.dmp

Filesize
136KB

Download
memory/4740-11-0x00007FFA03A40000-0x00007FFA04501000-memory.dmp

Filesize
10.8MB

Download
memory/4740-12-0x00007FFA03A40000-0x00007FFA04501000-memory.dmp

Filesize
10.8MB

Download
memory/4740-16-0x00007FFA03A40000-0x00007FFA04501000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing