f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5

General

Target
f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe
Size 500KB
Sample261028-ea3daaw18n
SHA256 f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5
MD5 863e84aa329d8cbd65aa4adebdac6ac6
SHA1 dade4c2ebf3423ca4ba6f9df12dcacb0c78be512
SHA512 521284295a13af0996ff0ea2ca92099a82b817048291c09b0a7577de762da0f740506426d8b9349e83f966dd85d3d7cb36df6e56c377e76273686edb3a273224
SSDEEP 12288:2jYKkJj6GmZUm/u2Wo9O7GMGjonPyYySK:YYb6nZjuBowCMGUnPNySK
TLSH
T1AFB44D53AB50A02DF1A389B0F9B4A2575C2A7D350A58EC1BB3405F5935725E3ACF072F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe

Executes dropped EXE 1 IoCs

pid	Process
1940	GoogleChrome.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5772	wscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\GoogleChrome.exe	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleChrome.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5896	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5896	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5724	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 5896	5724	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe	88
PID 5724 wrote to memory of 5772	5724	f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe	91
PID 5772 wrote to memory of 1940	5772	wscript.exe	92

C:\Users\Admin\AppData\Local\Temp\f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe
"C:\Users\Admin\AppData\Local\Temp\f8cdd87b0ca2565675ee95d380679129d83b460e8bb7ad6986c5527c07112bc5.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\\Users\Public\strEncodedData.vbs" /elevated
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Program Files\Google\Chrome\Application\GoogleChrome.exe
    "C:\\Program Files\Google\Chrome\Application\GoogleChrome.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

1

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleChrome.exe

Path C:\Program Files\Google\Chrome\Application\GoogleChrome.exe
Size 81KB
SHA256 bab3b43558a3c1de2aee7014b8d50306d19f67399836066bd50f1dfedf053664
MD5 71948b29e1ae6ade71c104f09f8c122d
SHA1 96c3809d12b34331b823305e7ab7daa0905af742
SHA512 6e18cc3c9255fb7fbd1c1a2051ba673678b8f31eb71898fa90194a1207bb24499d287221acd69b6bd451ac5b20cf010de537147b0651fd51307b15eb73c5508f
SSDEEP 1536:BhEBrut+S+URZBQ/jNJ75aI+m77nED3zKjcFQeTLHV/wsWL4qcdle7HvUy:fiut+VUnBQ7N6m77nED3zKjkTL1nrlGb
TLSH
T13C836A91B5D1C8B1E4360D3518B8DAE19E2EFD304E259E6B3388067F4F346D09A25E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EncKeyChrome.txt

Path C:\Users\Public\EncKeyChrome.txt
Size 1KB
SHA256 5d1997543d276a9372f9599410fb545c340a38a3e8a71e258e84c5c659bde013
MD5 32df5f528a5f6495c39dbb192129022e
SHA1 4d07f73f16cfe104586b93ff3492bdb0e0f0c980
SHA512 b017d80426709bb53427e25656b9c11d6382af84de5d6ea8e957987e2a24ca94818466e8cbcaebbb33db25cb9505f4f1b8b4af2e266be9e06396ca05a16092fa
TLSH
T16C21B77128BE70D1F200F48AB1647B566634F676EEF021082719F01E4DEC76FC1245AE
MD5 SHA1 SHA512 TLSH

Submit Download

strEncodedData.txt

Path C:\Users\Public\strEncodedData.txt
Size 109KB
SHA256 e1aed522b8cee663c3f66d8d79355849c437edf0ebe9d90b5006f15adcae3622
MD5 c5b0406b353c7a71e5a01f8f699b6f29
SHA1 e0bf526341c0da36d7063b8203bca300f434d5e6
SHA512 fb49f4daad9b5b08aa8b213526ec3629b1e19852cebab5a96732bf93993f6b8d9baf88c6ecc21e150b8bf1721edbea6b4f22bd49adae7b6273ad8b8c63f40c91
SSDEEP 1536:ZJDlt2vnB2FwlaGvFxrnzLSxkbx/bARm/Psz4K1lXvg09gaiPZNN17mCGYnp:ZJpInB2+laG9BCxkbxzEmXsz4SpCPLFp
TLSH
T177B37C378517BEAA072E2E889C0C2D525D782FE7C7388664EAC95C67B18A404DF5D4BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

strEncodedData.vbs

Path C:\Users\Public\strEncodedData.vbs
Size 4KB
SHA256 1d341c53b4688dba866b9f4826858beb5aaaca060a87a11c575e2735ca5194bf
MD5 8f5b35603986a13920973884d18624d7
SHA1 ea1b5c2a9d1b06041261267a3eccb18f421ed9d4
SHA512 4be5e1762ebe8171e476650bfef07f07b1e5dbe587632cf9e21c64cc0ce9acd0c84a457b6ba42e579da4ee6a6303305979fa2289b56bc799dcbe7a38ffec6b00
SSDEEP 96:YaAt2DghGp6NsCJmlyi2T43wVZvMkSOgIFA7VGODWGYrSoyNSb:YsdSsOmlyTaDer0Sb
TLSH
T1E79162093CBBA6515C92CF4A404A0ACCECCE8A27273DA51DF935056D2F383D742FE91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads