6effe24849d68c42a2f4d0f906205cb8294ec11d1fb440e084b7113bd9a8e308

General

Target
steal_dry.exe
Size 206KB
Sample260801-b5ry9avepf
SHA256 6effe24849d68c42a2f4d0f906205cb8294ec11d1fb440e084b7113bd9a8e308
MD5 05c69e754ac47e7d44f70667f2524205
SHA1 c8df7c5f369655c29a6b1dce1ef8a3202d4f63d7
SHA512 bdca467fbd4bbe75d2be11cab9e815b1aa87550fb000050e6f1c42cd2123730f9d19fab34494664acbca800b0626b604affc09bf035d2770665b6894bad69d46
SSDEEP 3072:axQjPYFMrHKbL81xlM9XnpU3B4X13RZ24s1am+rJ39HaIXZMlWSPy//O:3TIk1xlM9Xnp5F3qoJpILc/
TLSH
T176247B5AB3A500F9E877C138CC568502E572741657309BEF03A08BB6AF276D1ED3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6644	cmd.exe
3696	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3696	cmd.exe
4444	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5060	steal_dry.exe
5060	steal_dry.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 6644	5060	steal_dry.exe	91
PID 6644 wrote to memory of 6076	6644	cmd.exe	93
PID 5060 wrote to memory of 3696	5060	steal_dry.exe	94
PID 3696 wrote to memory of 4444	3696	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\steal_dry.exe
"C:\Users\Admin\AppData\Local\Temp\steal_dry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmdkey /list
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6644
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

1

T1016

Wi-Fi Discovery

1

T1016.002

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apps.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\apps.txt
Size 3KB
SHA256 7942f5f9ac32ec4b5f34f1cff012314853c8111997553d75b880aa484fa5eac1
MD5 fe5708c2936c8e960e7a2135bc7a3d3b
SHA1 69696d1216eaa033418085c54644c4d3c91bc69d
SHA512 5e009f1330644dd5aea4fbe12586b467533a26056206e53a847b057561464d813301dacbb91221df6ed55e892cb07890590128a1c2c35404669b87538e63fc70
TLSH
T1A261CF0E4EA56159CD64B2C6B0B24D18B58F67CBFBD0EEA600C9095DC40FBC7D2BD2A0
MD5 SHA1 SHA512 TLSH

Submit Download

cmdkey.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\cmdkey.txt
Size 174B
SHA256 0d51aeee5cbbd702365714d9caef5ccf7baed57ce0a97661fe0e68a31d168f75
MD5 8f16e973d3eaaa3dcdfc19d1392acd8a
SHA1 678c8ebcefddff5263fdfdff3e7ef807eed8d595
SHA512 5db97f166a86d7043363ff023cac554ac30e69b50c4fd4b77d7c68b434be5d486ef6c3e52f7e55bacfdf79a63fd0a832949490344bd1df8cc5412cd214b06549
TLSH
T101C080486565C0747E32432FF0024354F354659B57070D107549014E9F741D55756167
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\debug.txt
Size 342B
SHA256 c81489f77a5245d341baf2edac3586effc8594c86fa7751196faad719ca485db
MD5 9af9c593bec997fc64d4945384088441
SHA1 4528cfbe6c1e906f63315e5bf02c8c79518a2a7c
SHA512 95549f03f29033cfa4383acaeddfd181ec4a2e7b59d7a47c8270c7af37f0904598af5140c7d77d2a2802bc548f168e56e4fca4a3b333f6c7a1c67d00fb637c63
TLSH
T133E02016DBC7855B1A7CA1ED5816C41CD87450032EAD23253785C0D4E045597BCD534D
MD5 SHA1 SHA512 TLSH

Submit Download

processes.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\processes.txt
Size 985B
SHA256 9820952edcb67b1b7765052684e245679f06ed18872e0e26818b82d11a2223b1
MD5 2c07840a2d41369c2fa2144675007e65
SHA1 c41dba7c32b39728bfec23433f837e5afff60015
SHA512 26fab63a974e659288f2cfd900318eff5628bdb5fb72dc58274fa56b4d0b765cf0fa7b023cd2225674884e74dcf3c3f9ed39e001c069b2ea4031a8a4febc233c
TLSH
T17011371EC58AC9C08D2660CA632695C7B74326034250ADEE666BCE3C71564ADE3E37A1
MD5 SHA1 SHA512 TLSH

Submit Download

processes.txt

Path C:\Users\Admin\AppData\Local\Temp\loot_dump\processes.txt
Size 1KB
SHA256 e6613097dd6b2adc04313197a67e0b783aa6ba89bcdd12a44f447dad60e52ee5
MD5 106370164690eb59c15dd700c2547a85
SHA1 6cb3e080898a72588fd22aa620043ce891fca438
SHA512 876bed21ecdf77e2ad733743933ee753c3001bbe949de93f06a6a78c1fc9423b538fa133f047a4b84915557f7bb830d5afc442d89d200a903a31c5e085e07293
TLSH
T1E831CA1DC48ACAC00D2620D2536261C7F753A60282267CDF762BCE3D71868ADE3E73D1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads