Analysis
-
max time kernel
155s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 16:16
Static task
static1
Behavioral task
behavioral1
Sample
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe
Resource
win10v2004-20220812-en
General
-
Target
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe
-
Size
960KB
-
MD5
9f0b0d64d88d037951d4b5e64507dac2
-
SHA1
196695c896555a2e185c0ef14896d38545829dfe
-
SHA256
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16
-
SHA512
dd79aa8765ad3b854be3e4a5f08234355c73a7c29980928aa3132cf2c4c9eb8e4c7ee3663d778d1dd4f38bb82ec8fb69fdf9093cc794dfa455ae34da67b54866
-
SSDEEP
12288:BXcWQS3mu5hlQ/UQeq0uLOJ7RKgmxt0e67dAyrGulWEsAXoAUX1buqR2Dtsvv:BRBU0xGy2M3qs2vv
Malware Config
Signatures
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dxaesDYlYLmJH = "C:\\Users\\Admin\\AppData\\Roaming\\dxaesDYlYLmJH.exe" c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exedescription pid process target process PID 4340 set thread context of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exedescription pid process target process PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe PID 4340 wrote to memory of 4308 4340 c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe"C:\Users\Admin\AppData\Local\Temp\c9e5b898d1120b963be4637921a30265f851ae90ccbb4ce8c3967880b2efda16.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4308-133-0x0000000000000000-mapping.dmp
-
memory/4308-134-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/4308-136-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/4308-137-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/4340-132-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/4340-138-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB