6effe24849d68c42a2f4d0f906205cb8294ec11d1fb440e084b7113bd9a8e308

General

Target
steal_dry.exe
Size 206KB
Sample260801-b5ry9avepf
SHA256 6effe24849d68c42a2f4d0f906205cb8294ec11d1fb440e084b7113bd9a8e308
MD5 05c69e754ac47e7d44f70667f2524205
SHA1 c8df7c5f369655c29a6b1dce1ef8a3202d4f63d7
SHA512 bdca467fbd4bbe75d2be11cab9e815b1aa87550fb000050e6f1c42cd2123730f9d19fab34494664acbca800b0626b604affc09bf035d2770665b6894bad69d46
SSDEEP 3072:axQjPYFMrHKbL81xlM9XnpU3B4X13RZ24s1am+rJ39HaIXZMlWSPy//O:3TIk1xlM9Xnp5F3qoJpILc/
TLSH
T176247B5AB3A500F9E877C138CC568502E572741657309BEF03A08BB6AF276D1ED3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4072	cmd.exe
1740	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1740	cmd.exe
3344	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
916	steal_dry.exe
916	steal_dry.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4072	916	steal_dry.exe	86
PID 4072 wrote to memory of 4984	4072	cmd.exe	88
PID 916 wrote to memory of 1740	916	steal_dry.exe	89
PID 1740 wrote to memory of 3344	1740	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\steal_dry.exe
"C:\Users\Admin\AppData\Local\Temp\steal_dry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmdkey /list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Browser Information Discovery

Query Registry

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apps.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\apps.txt
Size 1KB
SHA256 ec98487e62e115689274453b19c68a9b51f08bfc73a756c237a4fade9f2f7109
MD5 efaefcbba9261eb507406d32b956398a
SHA1 577df7728d28d9fb410e6bcb8dcb263d905d6633
SHA512 2650707a184b6b2cdcd4c4649d6c792fd64ed56bc248b10469562935d7014c5d3b532f13a4ba4642f5d0de78b1d93779ec3037405fa6b776df0e7fa8a32995da
TLSH
T175219B0E4EA5A5698960F48661728E18769F378BBFD0AE3140CD0519C01F7C7D6FD2F0
MD5 SHA1 SHA512 TLSH

Submit Download

apps.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\apps.txt
Size 3KB
SHA256 3e3c0cf95e065bb7144324b8245d7fbd66af5c8c30eb6e1a82530363ce5a7757
MD5 0420dfbc45162c36b0657580fb846de0
SHA1 058c40912ea8fea47d5d19514e087862b3765b55
SHA512 6bd1bf5b2505a92eae9ee57b3f1d681c68f3f771cfc08d501cc015bad8d788eadfe615b68d80095550f800ca9e3ac333f49238625ccc5e8ce5d6b134d09234a5
TLSH
T1A161CF0E4EA56159CC64B2C6B0B24D18B58F67CBFBD0EEA600C9095DC40FBC7D2BD2A0
MD5 SHA1 SHA512 TLSH

Submit Download

processes.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\processes.txt
Size 708B
SHA256 86ae3f32163cb50fed20db7b820fce2683174106566a56cb7d75b3b6b0e12d7a
MD5 1cfa6f1feb793a2a4addce8f36bf96da
SHA1 323abe1e2bffba7f186c5a5517a453bc10c802be
SHA512 f929e3391037b490d8f29bf9b920e784714c4ff309904af39bb03b371260766497f688b64c04f9bae9e147d0ad6995f760790a208b0cfd59c15544eb117c8b92
TLSH
T172011519C98DCAC1492231C5236550C3B71396034A11ACEF6A7FC93C72554ADD3E3366
MD5 SHA1 SHA512 TLSH

Submit Download

processes.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\processes.txt
Size 1KB
SHA256 64be0d72a5d0790b20e0574a2dd129766d9ec442998e1944fde61f4fd0a21a61
MD5 5324fa47dc2b21c91641f8e4087bdf12
SHA1 505e9b1dd3f0f2f7c498723ee90da2e899cae62a
SHA512 b49e7e1f78311e807e0881147459f50b4c34ebb0df90965bc1ef8c46151c250be3bc0aae2d2e63542617995f46dc1d323489f5c8a6ae47e4283ad88c6e456c4b
TLSH
T1F6318B2CC8C9CAC1182220E5136151D3B74766034668BDDFAA6BCA3C321586CD3E77A5
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite_tmp.db

Path C:\Users\Admin\AppData\Local\Temp\sqlite_tmp.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads