Overview

overview

10

Static

static

e282d7499e...31.exe

windows7-x64

10

e282d7499e...31.exe

windows10-2004-x64

Analysis

  • max time kernel
    189s
  • max time network
    206s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 17:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e282d7499eeb5510edc61debee35c3fc83a785a944e2f487bd470590f6c1a031.exe

  • Size

    76KB

  • MD5

    c5ca1f7f8bbe72dfcbfe371589e13ea7

  • SHA1

    bda4a59da1bdce3d205a4bfb5fcf6c462d0a0792

  • SHA256

    e282d7499eeb5510edc61debee35c3fc83a785a944e2f487bd470590f6c1a031

  • SHA512

    c1a64e19c12c03fdc8b716a78f256552036ff20ed56a5df3eff96f85e9e28f73282cca08f529cd48ea4bf65de17a8f6d861cf9e5b5f45961089f9490bcec1bbc

  • SSDEEP

    1536:9W8QnR+yvHeZT71FeKtqT0Rqz/mp1tKIUjt:wRmT5FXqgIyp1tKLjt

Score
10/10
persistencespywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    overcomer123

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e282d7499eeb5510edc61debee35c3fc83a785a944e2f487bd470590f6c1a031.exe
    "C:\Users\Admin\AppData\Local\Temp\e282d7499eeb5510edc61debee35c3fc83a785a944e2f487bd470590f6c1a031.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops autorun.inf file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1704

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1704-54-0x0000000076191000-0x0000000076193000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1704-55-0x0000000074C90000-0x000000007523B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1704-56-0x0000000000A66000-0x0000000000A77000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1704-57-0x0000000074C90000-0x000000007523B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1704-58-0x0000000000A66000-0x0000000000A77000-memory.dmp

    Filesize

    68KB

    Download