Analysis
-
max time kernel
55s -
max time network
55s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-02-2021 06:55
Static task
static1
Behavioral task
behavioral1
Sample
Archive-541b.exe
Resource
win7v20201028
General
-
Target
Archive-541b.exe
-
Size
1.4MB
-
MD5
c8d498122478c4941c5b2d2d97ec3a30
-
SHA1
b50be0c98c44ff1eaf44d31f8b8d541afbbb4bfb
-
SHA256
d57d259f26333fe3798dc7a9b4f34ef9a1f18f7b320a9b4022bb56756d68fbba
-
SHA512
3c296961d10a3a55f4a6d57b209ce246517ffceade877a521622f301d030c0edc16553a46b5f443b975e9dc4f2be90171e2c5050a74efe32cfb254401c080dea
Malware Config
Signatures
-
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft \Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe Nirsoft -
Executes dropped EXE 6 IoCs
Processes:
Stely.exeresourcefilehaha.exeresourcefilehaha2.exeStely.exeresourcefilehaha.exeresourcefilehaha2.exepid process 624 Stely.exe 1624 resourcefilehaha.exe 1980 resourcefilehaha2.exe 1692 Stely.exe 440 resourcefilehaha.exe 1596 resourcefilehaha2.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe upx C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe upx \Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe upx \Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe upx \Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe upx C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe upx -
Processes:
resource yara_rule C:\Users\Admin\Desktop\Stely.exe vmprotect C:\Users\Admin\Desktop\Stely.exe vmprotect behavioral1/memory/624-9-0x0000000001310000-0x0000000001311000-memory.dmp vmprotect C:\Users\Admin\Desktop\Stely.exe vmprotect behavioral1/memory/1692-36-0x0000000001310000-0x0000000001311000-memory.dmp vmprotect -
Loads dropped DLL 12 IoCs
Processes:
Stely.exeStely.exepid process 624 Stely.exe 624 Stely.exe 624 Stely.exe 624 Stely.exe 624 Stely.exe 624 Stely.exe 1692 Stely.exe 1692 Stely.exe 1692 Stely.exe 1692 Stely.exe 1692 Stely.exe 1692 Stely.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
Archive-541b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main Archive-541b.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
resourcefilehaha.exeresourcefilehaha.exepid process 1624 resourcefilehaha.exe 1624 resourcefilehaha.exe 440 resourcefilehaha.exe 440 resourcefilehaha.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Stely.exeStely.exedescription pid process Token: SeDebugPrivilege 624 Stely.exe Token: SeDebugPrivilege 1692 Stely.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Archive-541b.exepid process 1724 Archive-541b.exe 1724 Archive-541b.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Stely.exeStely.exedescription pid process target process PID 624 wrote to memory of 1624 624 Stely.exe resourcefilehaha.exe PID 624 wrote to memory of 1624 624 Stely.exe resourcefilehaha.exe PID 624 wrote to memory of 1624 624 Stely.exe resourcefilehaha.exe PID 624 wrote to memory of 1624 624 Stely.exe resourcefilehaha.exe PID 624 wrote to memory of 1980 624 Stely.exe resourcefilehaha2.exe PID 624 wrote to memory of 1980 624 Stely.exe resourcefilehaha2.exe PID 624 wrote to memory of 1980 624 Stely.exe resourcefilehaha2.exe PID 624 wrote to memory of 1980 624 Stely.exe resourcefilehaha2.exe PID 1692 wrote to memory of 440 1692 Stely.exe resourcefilehaha.exe PID 1692 wrote to memory of 440 1692 Stely.exe resourcefilehaha.exe PID 1692 wrote to memory of 440 1692 Stely.exe resourcefilehaha.exe PID 1692 wrote to memory of 440 1692 Stely.exe resourcefilehaha.exe PID 1692 wrote to memory of 1596 1692 Stely.exe resourcefilehaha2.exe PID 1692 wrote to memory of 1596 1692 Stely.exe resourcefilehaha2.exe PID 1692 wrote to memory of 1596 1692 Stely.exe resourcefilehaha2.exe PID 1692 wrote to memory of 1596 1692 Stely.exe resourcefilehaha2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Archive-541b.exe"C:\Users\Admin\AppData\Local\Temp\Archive-541b.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Stely.exe"C:\Users\Admin\Desktop\Stely.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe"C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe" /C /stext C:\Users\Admin\AppData\Local\Temp\credentialslmao.txt2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe"C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe" /C /stext C:\Users\Admin\AppData\Local\Temp\cookieslmao.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Stely.exe"C:\Users\Admin\Desktop\Stely.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe"C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exe" /C /stext C:\Users\Admin\AppData\Local\Temp\credentialslmao.txt2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe"C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exe" /C /stext C:\Users\Admin\AppData\Local\Temp\cookieslmao.txt2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cookieslmao.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\cookieslmao.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\credentialslmao.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\credentialslmao.txtMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exeMD5
4a82a984210f0d4fcc24649f8248687e
SHA154127c2d922ac623741be36857cd6ba737016a0c
SHA256c95ed6164ca6ed4f2ea67807d1d1c9e99c19ed244dc53a5ddb2ba34c4aa2efd6
SHA5121ac051019f430f16048759de8c9e97b5600e7ac537016c71e771fc14b4a6c3bda139b16449a251abe3b1ad3faa8afd718d573d079ce6d425e9217b540bbdffdb
-
C:\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exeMD5
4a82a984210f0d4fcc24649f8248687e
SHA154127c2d922ac623741be36857cd6ba737016a0c
SHA256c95ed6164ca6ed4f2ea67807d1d1c9e99c19ed244dc53a5ddb2ba34c4aa2efd6
SHA5121ac051019f430f16048759de8c9e97b5600e7ac537016c71e771fc14b4a6c3bda139b16449a251abe3b1ad3faa8afd718d573d079ce6d425e9217b540bbdffdb
-
C:\Users\Admin\Desktop\AForge.Video.DirectShow.dllMD5
17ed442e8485ac3f7dc5b3c089654a61
SHA1d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA256666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
SHA5129118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
-
C:\Users\Admin\Desktop\Stely.exeMD5
e7c3f530cf00076c250c6bcbc64c0a06
SHA185e15cb1322674b2e244cc454964e7af63618081
SHA2569acd171925e00b11abed564f3eddd2dcb62f00731060d786affe4490de4a7517
SHA512ef35342d8d16a7ea0cfde172eb919aa8b4798e21718d17990975b114bacfc5fe97b779468e0895ccd33ce59fceb788054fc1f4135f83238b333d27c742bda682
-
C:\Users\Admin\Desktop\Stely.exeMD5
e7c3f530cf00076c250c6bcbc64c0a06
SHA185e15cb1322674b2e244cc454964e7af63618081
SHA2569acd171925e00b11abed564f3eddd2dcb62f00731060d786affe4490de4a7517
SHA512ef35342d8d16a7ea0cfde172eb919aa8b4798e21718d17990975b114bacfc5fe97b779468e0895ccd33ce59fceb788054fc1f4135f83238b333d27c742bda682
-
C:\Users\Admin\Desktop\Stely.exeMD5
e7c3f530cf00076c250c6bcbc64c0a06
SHA185e15cb1322674b2e244cc454964e7af63618081
SHA2569acd171925e00b11abed564f3eddd2dcb62f00731060d786affe4490de4a7517
SHA512ef35342d8d16a7ea0cfde172eb919aa8b4798e21718d17990975b114bacfc5fe97b779468e0895ccd33ce59fceb788054fc1f4135f83238b333d27c742bda682
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha.exeMD5
053778713819beab3df309df472787cd
SHA199c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA256f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
SHA51235a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exeMD5
4a82a984210f0d4fcc24649f8248687e
SHA154127c2d922ac623741be36857cd6ba737016a0c
SHA256c95ed6164ca6ed4f2ea67807d1d1c9e99c19ed244dc53a5ddb2ba34c4aa2efd6
SHA5121ac051019f430f16048759de8c9e97b5600e7ac537016c71e771fc14b4a6c3bda139b16449a251abe3b1ad3faa8afd718d573d079ce6d425e9217b540bbdffdb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exeMD5
4a82a984210f0d4fcc24649f8248687e
SHA154127c2d922ac623741be36857cd6ba737016a0c
SHA256c95ed6164ca6ed4f2ea67807d1d1c9e99c19ed244dc53a5ddb2ba34c4aa2efd6
SHA5121ac051019f430f16048759de8c9e97b5600e7ac537016c71e771fc14b4a6c3bda139b16449a251abe3b1ad3faa8afd718d573d079ce6d425e9217b540bbdffdb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exeMD5
4a82a984210f0d4fcc24649f8248687e
SHA154127c2d922ac623741be36857cd6ba737016a0c
SHA256c95ed6164ca6ed4f2ea67807d1d1c9e99c19ed244dc53a5ddb2ba34c4aa2efd6
SHA5121ac051019f430f16048759de8c9e97b5600e7ac537016c71e771fc14b4a6c3bda139b16449a251abe3b1ad3faa8afd718d573d079ce6d425e9217b540bbdffdb
-
\Users\Admin\AppData\Local\Temp\resourcefilehaha2.exeMD5
4a82a984210f0d4fcc24649f8248687e
SHA154127c2d922ac623741be36857cd6ba737016a0c
SHA256c95ed6164ca6ed4f2ea67807d1d1c9e99c19ed244dc53a5ddb2ba34c4aa2efd6
SHA5121ac051019f430f16048759de8c9e97b5600e7ac537016c71e771fc14b4a6c3bda139b16449a251abe3b1ad3faa8afd718d573d079ce6d425e9217b540bbdffdb
-
\Users\Admin\Desktop\AForge.Video.DirectShow.dllMD5
17ed442e8485ac3f7dc5b3c089654a61
SHA1d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA256666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
SHA5129118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
-
\Users\Admin\Desktop\AForge.Video.DirectShow.dllMD5
17ed442e8485ac3f7dc5b3c089654a61
SHA1d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA256666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
SHA5129118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
-
\Users\Admin\Desktop\AForge.Video.DirectShow.dllMD5
17ed442e8485ac3f7dc5b3c089654a61
SHA1d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA256666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
SHA5129118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
-
\Users\Admin\Desktop\AForge.Video.DirectShow.dllMD5
17ed442e8485ac3f7dc5b3c089654a61
SHA1d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA256666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
SHA5129118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
-
memory/440-48-0x0000000000000000-mapping.dmp
-
memory/624-9-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/624-19-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/624-8-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/624-12-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/624-11-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/1596-55-0x0000000000000000-mapping.dmp
-
memory/1624-22-0x0000000000000000-mapping.dmp
-
memory/1692-35-0x0000000074630000-0x0000000074D1E000-memory.dmpFilesize
6.9MB
-
memory/1692-36-0x0000000001310000-0x0000000001311000-memory.dmpFilesize
4KB
-
memory/1692-42-0x0000000009250000-0x0000000009251000-memory.dmpFilesize
4KB
-
memory/1692-41-0x0000000000500000-0x0000000000501000-memory.dmpFilesize
4KB
-
memory/1724-2-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1724-3-0x0000000001000000-0x0000000001001000-memory.dmpFilesize
4KB
-
memory/1896-5-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1980-30-0x0000000000000000-mapping.dmp