f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe
Size

2.6MB
MD5

049ad41c3ed549c6eb4cbb6f489e035c
SHA1

a28e0a65b16b5be157681695a1bc4b2f7a08f186
SHA256

f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c
SHA512

80faacbcc5f837dc2cf610f5c895927d35a7e83c2dddabd680316a707ded9cdcaf58837eea72949941edf9b3c42674ef8a807cff2c04ee789f836f9545e2c2d0
SSDEEP

49152:U5epFvrA7VqFN/9UtpEd73VBbP7zwByo26r3tLiMoSzbqKM/ULLV/jb:sepFvU7VI/9D7lB3zwBn3gMoSHdcQx/3

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1912	AskInstallChecker.exe

Loads dropped DLL 4 IoCs

pid	Process
1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe
1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe
1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe
1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27
PID 1336 wrote to memory of 1912	1336	f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe	27

C:\Users\Admin\AppData\Local\Temp\f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe
"C:\Users\Admin\AppData\Local\Temp\f97d0c2274ff7fa45b2b4c435c0adadedf09ebb7a57c79daaa79dbec6a058d0c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\AskInstallChecker.exe
  "C:\Users\Admin\AppData\Local\Temp\AskInstallChecker.exe" MP3
  2⤵
  - Executes dropped EXE
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AskInstallChecker.exe

Filesize
242KB

MD5
8f9b5f4f87207be1cf810ddc95124f92

SHA1
f5cec54c9aac59167ba95ec8077438be381fba3d

SHA256
4501e3f8f41966d403e76d3b1d04525098f0b6d41b65741a8351f3b0d3e4397e

SHA512
dac421d8132e474ddfc9ba5954928b40d952af17c4c2085c30f5f3dc631962c2f05db52cb487371108b6b61e6fbc0a82d68ced48e9075a1fbc5a214d5d201097

Download Submit
\Users\Admin\AppData\Local\Temp\AskInstallChecker.exe

Filesize
242KB

MD5
8f9b5f4f87207be1cf810ddc95124f92

SHA1
f5cec54c9aac59167ba95ec8077438be381fba3d

SHA256
4501e3f8f41966d403e76d3b1d04525098f0b6d41b65741a8351f3b0d3e4397e

SHA512
dac421d8132e474ddfc9ba5954928b40d952af17c4c2085c30f5f3dc631962c2f05db52cb487371108b6b61e6fbc0a82d68ced48e9075a1fbc5a214d5d201097

Download Submit
\Users\Admin\AppData\Local\Temp\nsi733.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
\Users\Admin\AppData\Local\Temp\nsi733.tmp\LangDLL.dll

Filesize
5KB

MD5
9384f4007c492d4fa040924f31c00166

SHA1
aba37faef30d7c445584c688a0b5638f5db31c7b

SHA256
60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

SHA512
68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

Download Submit
\Users\Admin\AppData\Local\Temp\nsi733.tmp\UAC.dll

Filesize
17KB

MD5
09caf01bc8d88eeb733abc161acff659

SHA1
b8c2126d641f88628c632dd2259686da3776a6da

SHA256
3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

SHA512
ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

Download Submit
memory/1336-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download