3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1

General

Target
jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
Size 64KB
Sample260924-mfa5zsbc49
SHA256 3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1
MD5 dd712e46e2e816cc728515cff217b94c
SHA1 a1d4c74d2bdb48217374a3bdc40d8b5ed8fc19ad
SHA512 6d34cb8d823a5151217febc1d6b4a98bd07652d381b5a7dc3c09917a173f4f54cb24e2c9f89f9743b18b08e4c43ab8ca4590752b0bb29686d33c889a0a5af27b
SSDEEP 768:uDZbazb/nxQfrhr+OLWAG3xyzipDlbAXah1x8sScyjNMur9i7E1:uD8bqMtAGhIibGavx8sJuhi7E1
TLSH
T15653498DA589CEE1ED4709B0066395B8C573316715D1A6AAEECCCCDC473AC217D38ECA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3212	rundll32.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Loads dropped DLL 1 IoCs

pid	Process
3212	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysapp23.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\midimap.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\ksuser.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\msimg32.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4908	sc.exe
5536	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4604	1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe	87
PID 1888 wrote to memory of 5536	1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe	88
PID 1888 wrote to memory of 4908	1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe	89
PID 4604 wrote to memory of 4680	4604	net.exe	93
PID 1888 wrote to memory of 3212	1888	jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5536
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1790245567.dat, ServerMain c:\users\admin\appdata\local\temp\jaffacakes118_3b549a7eb8f7d8c9634048ed27fc055550133611d4d424d6368efc0264162fc1.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Service Stop

2

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1790245567.dat

Path C:\Users\Admin\AppData\Local\Temp\1790245567.dat
Size 33KB
SHA256 4a42ed614956ff007484b86e91364d901bace8801cd0b30d2b77ffcf85880b05
MD5 7ac6c06aa66882333882ff5973733617
SHA1 1ed98e52f6378bc79e15c3508e810a3f73f29616
SHA512 34ea1062f440aba5f51c8b9d23d2d8ba474df6408ed73ef1deef44d5eb9d67a05c1679e3d2acd86c71487fc03be7c14e7807d7815c0e209a5c91dece67c5c959
SSDEEP 768:VBB+Ys5Z405OOtG2YS63TX/7gqLjB7cOt0ERUAa0e5Z:TB+Ys5ZlnG2YBjv7gqLClERUWe5Z
TLSH
T1E3F26C137A4784A2D2A3813176852B79CBFC78704E0752AADF72CB4B1D715C3EA3A607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing