Analysis
- max time kernel
162s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
05/09/2022, 05:08
General
- Target f50067a8360984103ed26b5ec84dd89d.exe
- Size 416KB
- Sample220905-fsq9eabeak
- SHA256 3aec0d15d3dbb820e92cb7ee3c49d277aecb1d34df4c6f854afb4f76758ceaa7
Score
10/10
Malware Config
Signatures
- Detect WinDealer information stealer 2 IoCs
- WinDealer
WinDealer is an info stealer used by LuoYu group.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f50067a8360984103ed26b5ec84dd89d.exe"C:\Users\Admin\AppData\Local\Temp\f50067a8360984103ed26b5ec84dd89d.exe"1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-132-0x0000000010000000-0x000000001003C000-memory.dmp
memory/4636-133-0x0000000010000000-0x000000001003C000-memory.dmp