Overview

overview

6

Static

static

5

352aa870af...36.exe

windows7_x64

6

352aa870af...36.exe

windows10-2004_x64

5

Analysis

  • max time kernel
    47s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    19-06-2022 18:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36.exe

  • Size

    1.6MB

  • MD5

    dc3a81cc4f57944f8769d3af969c3a80

  • SHA1

    b5985ce4c9d0edd85194082cc7fed320dc7fbaad

  • SHA256

    352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36

  • SHA512

    ac661795dcc06e75d85d6903f2c67ca0c85cbf8ba566829ea3edb4e0e79bddbf10c5ddc9752f1998dc28ad48f2dc51b2c088f0ecde6d54650bffa861f0179b64

Score
6/10
spywarestealer

Malware Config

Signatures

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36.exe
    "C:\Users\Admin\AppData\Local\Temp\352aa870af4367dbfbd69e97f933e7eb88fdbc2b9c6f06fc44550eb6cc3cce36.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Enumerates system info in registry
      PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Connection Proxy

1
T1090

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1512-54-0x0000000076421000-0x0000000076423000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1512-56-0x0000000000180000-0x00000000001EE000-memory.dmp
    Filesize

    440KB

    Download
  • memory/1684-55-0x000000000044B213-mapping.dmp
    Download
  • memory/1684-57-0x0000000000400000-0x0000000000471000-memory.dmp
    Filesize

    452KB

    Download
  • memory/1684-58-0x0000000000400000-0x0000000000471000-memory.dmp
    Filesize

    452KB

    Download