Analysis
-
max time kernel
175s -
max time network
198s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 20:58
General
-
Target
182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb.exe
-
Size
722KB
-
MD5
8e910184cbe93a98e107ef6eb7809004
-
SHA1
ce5525f237cf0d9a01ced51874ccbf83ca9321bf
-
SHA256
182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb
-
SHA512
08abac662dbafcf129f19723fd557ba0fd2d02753726c65e350e7080c2ae84be9fe8f7e42e22b8866021ac651c127070086c148dc69037da003b7cdbc4c7d040
-
SSDEEP
12288:t81Ed0hYcVhenSZ/8H45yo96jxrE05xdm/KFtUmuX/BoAUEaZuT5On:t81EdVcVYSZncJZEqqEUZPBoAUEKuT52
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb.exe"C:\Users\Admin\AppData\Local\Temp\182d01af549f30b21c9987c2c85eef620eebe6c9202e689f92e8cd4dbf9284eb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fbupdate.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\fbupdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
327KB
MD535f1cf871c50e1a13c5430c926b94148
SHA190df8df3dcfc20d1e549bbe50f9627e51c801070
SHA256a0776e68d42e920a1ce36716d9d7ecd251e32ec2ef0d9f74340dc3f3e2b50171
SHA512e576d00ef6514cd11434a2ad015eaa80e3d2533ab1e3b39d00c0a3c653f3374eb5c94db708109118e017a030d87fa70601fb1b839e51d4098c26eecd98f1bd19
-
Filesize
327KB
MD535f1cf871c50e1a13c5430c926b94148
SHA190df8df3dcfc20d1e549bbe50f9627e51c801070
SHA256a0776e68d42e920a1ce36716d9d7ecd251e32ec2ef0d9f74340dc3f3e2b50171
SHA512e576d00ef6514cd11434a2ad015eaa80e3d2533ab1e3b39d00c0a3c653f3374eb5c94db708109118e017a030d87fa70601fb1b839e51d4098c26eecd98f1bd19
-
Filesize
586KB
MD52c7b219cd45e962c49b1834083c75183
SHA1053bbbfa1250baadd702ca3a9823552e1ed13d4d
SHA256d1cbb5835a4b94417501f59f179a235a02f1d64ed780fa51b5d6a39a5f565c59
SHA512132b518289358124329b3523ce561dfc23a2445d8360835f65303e11d774341b6996a29bff8d649806a1ae579c071761bc6fb19a70c677ff68085bd6be81dcf1
-
Filesize
586KB
MD52c7b219cd45e962c49b1834083c75183
SHA1053bbbfa1250baadd702ca3a9823552e1ed13d4d
SHA256d1cbb5835a4b94417501f59f179a235a02f1d64ed780fa51b5d6a39a5f565c59
SHA512132b518289358124329b3523ce561dfc23a2445d8360835f65303e11d774341b6996a29bff8d649806a1ae579c071761bc6fb19a70c677ff68085bd6be81dcf1
-
-
Filesize
2.1MB
-
Filesize
396KB
-
Filesize
244KB
-
Filesize
396KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
396KB