d7588407a02bc7bfcb9e346bd94c4fe1da06a2f25824025cf4bd4422cd101da3

General

Target
69mcl7d9.exe
Size 779KB
Sample251204-wfvdas1ncw
SHA256 d7588407a02bc7bfcb9e346bd94c4fe1da06a2f25824025cf4bd4422cd101da3
MD5 e3896136a6ed7e0d73aa697384e4f1c5
SHA1 f63b1fe56e874187b13f938153ed0526ea5b1961
SHA512 4de63dacde37d2866d1efa7a7fdcd45b7c8972b41ff358390d465f3cea728dd30d325caeb73cee64a769fd549ec3099c5148fd505467938ec27246bdda8547d9
SSDEEP 12288:eGLVpIo/cBJ9InRPehbyv8plnE5Lyv3YZtF15kjHL:ekkBJinRP6bw8TE5Lm3B
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	5712	69mcl7d9.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	ocsWjwNj4Xyg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	69mcl7d9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ocsWjwNj4Xyg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ocsWjwNj4Xyg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	69mcl7d9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ocsWjwNj4Xyg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ocsWjwNj4Xyg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ocsWjwNj4Xyg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ocsWjwNj4Xyg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ocsWjwNj4Xyg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	69mcl7d9.exe
5712	69mcl7d9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5712 wrote to memory of 3032	5712	69mcl7d9.exe	78
PID 5712 wrote to memory of 3032	5712	69mcl7d9.exe	78
PID 5712 wrote to memory of 5740	5712	69mcl7d9.exe	80
PID 5712 wrote to memory of 5740	5712	69mcl7d9.exe	80
PID 5712 wrote to memory of 108	5712	69mcl7d9.exe	82
PID 5712 wrote to memory of 108	5712	69mcl7d9.exe	82
PID 5712 wrote to memory of 1768	5712	69mcl7d9.exe	84
PID 5712 wrote to memory of 1768	5712	69mcl7d9.exe	84
PID 5712 wrote to memory of 2420	5712	69mcl7d9.exe	86

C:\Users\Admin\AppData\Local\Temp\69mcl7d9.exe
"C:\Users\Admin\AppData\Local\Temp\69mcl7d9.exe"
1⤵
- Downloads MZ/PE file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1768
- C:\Users\Admin\AppData\Local\ocsWjwNj4Xyg.exe
  "C:\Users\Admin\AppData\Local\ocsWjwNj4Xyg.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2420

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7232B3B2-9955-4056-61DA-0D3E598245A6.txt

Path C:\ProgramData\7232B3B2-9955-4056-61DA-0D3E598245A6.txt
Size 64B
SHA256 c02ece9615942311bc2db28ccb867b62974e1b2762b73b9b7719862d33a1b8fe
MD5 e9cb7a9e5ae6aec1bcdbd7e22fdc6bad
SHA1 697f0325be42c915bf05ec0310e7e0ef2b2efe2c
SHA512 c27c4e567b5b4496e0f0c0f72ff0d28fc18ac7f85e49651d8831e86966ea70589416c293bcdced39b6b046f0354bb3d00322ac751870c38628d32a2aa16a0553
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing