29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a

General

Target
29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe
Size 1.5MB
Sample260720-sy293sgw2x
SHA256 29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a
MD5 37ef6f74708643a7ca2ae36e767b4b0f
SHA1 e70f6c9c8810256e5423dfe3819c251383e921be
SHA512 74507d7f71d9d135993efe4cdf8338c689fb403efac724fba00269c48cbc13e1ca6e8ec4ce851a3ca4ad6d919bca7759f5fc5d98a90fc886464a0a3949c039c2
SSDEEP 49152:878YkxNeCAYmLq7647KYgMOX8jhuH7RR:/YQNefYm+7pK5MOX8j0b
TLSH
T1A075010B96A401FDE1EBD174CD535906EBB2FC0A4B71A69F03E449921F376A09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution persistence privilege_escalation stealer

Malware Config

Signatures

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2476	cmd.exe
1940	cmd.exe
5740	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5816	netsh.exe
2476	cmd.exe
6028	netsh.exe
1940	cmd.exe
5840	netsh.exe
5740	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2076	1396	29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe	90
PID 1396 wrote to memory of 2076	1396	29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe	90
PID 2076 wrote to memory of 2476	2076	chrome.exe	93
PID 2476 wrote to memory of 6028	2476	cmd.exe	95
PID 1396 wrote to memory of 1180	1396	29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe	96
PID 1396 wrote to memory of 1180	1396	29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe	96
PID 1180 wrote to memory of 1940	1180	msedge.exe	97
PID 1940 wrote to memory of 5840	1940	cmd.exe	99
PID 1396 wrote to memory of 5884	1396	29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe	100
PID 1396 wrote to memory of 5884	1396	29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe	100
PID 5884 wrote to memory of 5740	5884	firefox.exe	101
PID 5740 wrote to memory of 5816	5740	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe
"C:\Users\Admin\AppData\Local\Temp\29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh wlan show profiles
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Electrum.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Wallets\Electrum.txt
Size 73B
SHA256 0d44584b45475e9353f3ae220cf2eb9245aed3c72b6152e1d91321123896f799
MD5 4541962ad5e6d0b9d837543aa06c71aa
SHA1 286284224616fa31aac6aca7eb90f2acaa447b9a
SHA512 b822c2cf9d6d389018adb918e7dd5696932fb1679806e2f05e4ad91cebc157ad26094d5e6929dee4f15c4c25e014391e86aea6867778615fe70c8ee9d614e455
TLSH
T1F0A002E91BC5F70D74114A975AF2D0F8A474D9447F4C693BD74A444D2180CA4FC4105F
MD5 SHA1 SHA512 TLSH

Submit Download

Exodus.txt

Path C:\Users\Admin\AppData\Local\Temp\output\Wallets\Exodus.txt
Size 75B
SHA256 29cb643dd324fe6bac4263310c9b9f65dd089f8de278f6893459dd5665231d98
MD5 f8fb967abb0fe92feaee51f36085be58
SHA1 a103be3e824f3832121a779c5d0d4518b7affe1e
SHA512 699deae82e6a005b4ace8e2927a614f0c1a254de41a73a18401cd21b8e69807100af0b83a86f50b28e97ad4f104bf9ee532c3eced1f64e1e648e4c3db9cb3090
TLSH
T1ABA022B023C0830E380802CB8B33E0E800200A003F003E38C388FC082380C00BC00020
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads