f9c9919d782455d39dba3edaedae27fce4421ce745c68de36ff003c2acc8a8ad

General

Target
FreezePERMloader.exe
Size 19.7MB
Sample261002-y4yfza1bmd
SHA256 f9c9919d782455d39dba3edaedae27fce4421ce745c68de36ff003c2acc8a8ad
MD5 ac2c6ace493a05eb90c1ae0e8d332737
SHA1 0318c4f069b90f72c73673643e657369031651f6
SHA512 c48915036269a43b3cb50cc11e7e3bbaccae7dc791e68ccc5a8be33d02bdd68f69a8cbba66147be1303a225a543d7ea0c1180adfb45795a705e7a25a4a90bf05
SSDEEP 196608:TIYzRNiX/8Ftek0F9jenXe6OKuTPKg4i7Pidb75e:9iEWrF1enOxKQw+e8
TLSH
T10627A42239EB505DF3E2AAB94FD4B46F991AF633171E31FA207447468722E80CDA1735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4612	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FreezePERMloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FreezePERMloader.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreezePERMloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	FreezePERMloader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	FreezePERMloader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	FreezePERMloader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	FreezePERMloader.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2620	788	FreezePERMloader.exe	89
PID 788 wrote to memory of 3120	788	FreezePERMloader.exe	91
PID 788 wrote to memory of 5668	788	FreezePERMloader.exe	94
PID 788 wrote to memory of 400	788	FreezePERMloader.exe	96
PID 788 wrote to memory of 5460	788	FreezePERMloader.exe	98
PID 788 wrote to memory of 4944	788	FreezePERMloader.exe	100
PID 788 wrote to memory of 4340	788	FreezePERMloader.exe	102
PID 788 wrote to memory of 3760	788	FreezePERMloader.exe	104
PID 3760 wrote to memory of 4612	3760	cmd.exe	106
PID 3760 wrote to memory of 1872	3760	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\FreezePERMloader.exe
"C:\Users\Admin\AppData\Local\Temp\FreezePERMloader.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "CartPERMloader_TpmProfileBoot" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "CartPERMloader_TpmClearGuard" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3120
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "CartPERMloader_TpmClearGuardBoot" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5668
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "CartPERMloader_TpmClearGuardDaemon" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:400
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "CartPERMloader_TpmClearGuardDaemonBoot" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5460
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "VirexPERMloader_TpmProfileBoot" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4944
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN "FreezePERMloader_TpmProfileBoot" /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c sc query winmgmt | findstr RUNNING
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc query winmgmt
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\SysWOW64\findstr.exe
    findstr RUNNING
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872