windealer | 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
10-06-2022 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Size

364KB
MD5

cc7207f09a6fe41c71626ad4d3f127ce
SHA1

84e749c37978f9387e16fab29c7b1b291be93a63
SHA256

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa
SHA512

c7f236f1bafa9192ba30f40b6cbc0e74c89a5b4d7ae95fa98d1ace3857849ba37d2211a2c42bb4f348bd218e1ce28a7006bbda07e3e1e51c09a806da17f9f655

Score

10^/10

windealer stealer suricata trojan

Malware Config

Signatures

Detect WinDealer information stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1904-55-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral1/memory/1904-56-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer

WinDealer
WinDealer is an info stealer used by LuoYu group.
stealer trojan windealer
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
suricata: ET MALWARE Win32/WinDealer CnC Activity (Checkin)
suricata

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1904	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
1904	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
"C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-54-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/1904-55-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/1904-56-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download