0c4a9d3579485eaf8801e5ac479cd322ee1e7161b54cc24689b891fa82ba0f1e

General

Target
audioeq.exe
Size 2.1MB
Sample260502-e3b2sscz5j
SHA256 0c4a9d3579485eaf8801e5ac479cd322ee1e7161b54cc24689b891fa82ba0f1e
MD5 6c98b26c585eb06e969c52dad708a227
SHA1 016616281fbdd9f712cf41323b9df9b803904cdc
SHA512 0f8a154c047a2b239f59badb44563c6bcd74372e1819e0565b3d6fa1fb07e896f6f939e92a366ce6db7ceda2ebf13d5e1dba6aab67263a779bf9a18864123b00
SSDEEP 24576:ZRBeLnWQgsTqsXJzOjwgJs/gsLFtodR+/qFHlFUgewGSkTfeBlRZV:ZRBeDnTq6kwkebc+SxzuwGSZx
TLSH
T1C1A57C39B71082F2E64B81346A05A7C383BB7C7A375170FAA17E12D41E55A7A137E6F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioeq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioeq.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioeq.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioeq.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3384	audioeq.exe
3384	audioeq.exe
3384	audioeq.exe
3384	audioeq.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 5064	3384	audioeq.exe	79
PID 3384 wrote to memory of 4204	3384	audioeq.exe	82

C:\Users\Admin\AppData\Local\Temp\audioeq.exe
"C:\Users\Admin\AppData\Local\Temp\audioeq.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless
  2⤵
  PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6dmPyb688hWG1JtxquGz1Wdstdi23r

Path C:\Users\Admin\AppData\Local\Temp\6dmPyb688hWG1JtxquGz1Wdstdi23r
Size 32B
SHA256 14b139920eab62cb4208f1fe90cfacb7b44185937a2913ea7ff4e1ad44ee6195
MD5 33dbaecd41f3fb06ad54e804c5114601
SHA1 7b60f1d8cd926255980ddfe0f3c61d0051cd9c46
SHA512 0d7154c7f866a37247af84604faf90a88543b9cdb7c88f0b7f85295854b41cc73bed2a61f3b1208b3311f991b509fbfb93a1a40e5b3e0babad3dec84ec67e1ca
MD5 SHA1 SHA512

Submit Download

B5sI9DCqCp1WCiFqB

Path C:\Users\Admin\AppData\Local\Temp\B5sI9DCqCp1WCiFqB
Size 32B
SHA256 4d406f0fb7c74e22104a3c5a3266299ef5e8fa4e2b227b68361d81fc2d182182
MD5 6497b9f0cf8e63c32e6ec2582c75d5ff
SHA1 091850c0cd1e4db24c7f865184f94f5ca6fa5b2d
SHA512 2a77a29c71018ecea4b03edd2e4c3ebc14c45c15bbc4d198938d81628714eeb615dd4ca35deee04ec04563c04327f91f13b11c7b591eb11c8738e2249ab7fbca
MD5 SHA1 SHA512

Submit Download

SPR12NeUmnMpoDZY4X4

Path C:\Users\Admin\AppData\Local\Temp\SPR12NeUmnMpoDZY4X4
Size 578B
SHA256 9f1b198c5336b1feaa86ab9760aa538151ce9c75c11137a1e6975868d2c003cd
MD5 b0329f1bc002946af89aaff3eff13024
SHA1 06bbbda75ce0e585258fe2db15b0268e9ecea778
SHA512 aebc411d1b68cb70d184099a214441ab7ee18a0d65dc7bd76e8a4584b17b384a0a5838b8e06c7c047f7e0aa32b9a55b59934babfc4a925331c08632181e8405f
TLSH
T1F1F041749F12988AF105AE7D9D2B891CACE3F0203CB68001A9265082870EAD8E824F42
MD5 SHA1 SHA512 TLSH

Submit Download

x4McRPk3n4OKLqvYKC4hk5AfF

Path C:\Users\Admin\AppData\Local\Temp\x4McRPk3n4OKLqvYKC4hk5AfF
Size 640B
SHA256 b7c1b46cc4ed5abf115551bc88363705a450bc6c69d41b6cf81dcc52f9bc1f98
MD5 a7726e7dd5af18cb39e538d836e7d20d
SHA1 0e9c368f91f3fc85832e0ca36c31ec28ceb8545e
SHA512 180f24abe58fd0788d7c0912dd6af6c3a7625df352e929e2c965498540f532306ad0d897d499f9a5464c8ac4d7c624903279675d5090738318580c321f3dddc7
TLSH
T1E7F0237E43FC698375591934AC4704901AD6B8A3875166051646D05CE7043824A39BCA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3384-0-0x0000000140000000-0x00000001400C0000-memory.dmp

Download

memory/3384-15-0x000002A403D10000-0x000002A403DBE000-memory.dmp

Download

memory/3384-16-0x000002A403D10000-0x000002A403DBE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads