1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7.exe
Size

156KB
MD5

66a502dc76e48ece9d93b9b5818b4f10
SHA1

2e18c18e025b73870bed3bd5cbaa0981bf65cf7d
SHA256

1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7
SHA512

f7e0847a10c008d87fe715eb551ee1f0957021e549d8a3b9104270d8ad25a9164fb46d14c05298bcb213bc49fa62738bae3b3f67a053716a49a5e1f02680891b
SSDEEP

3072:ilikxQUzHLV/sidu5k9AvVt7G9K7b+EdK5upvq9nV5P5ghIvX6gKEzeGAHVNVNbE:ilikxQU6w3BpiOh

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4932	Friendster Bruteforce.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4900	4400	WerFault.exe	80

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4932	Friendster Bruteforce.exe
4932	Friendster Bruteforce.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4932	4400	1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7.exe	81
PID 4400 wrote to memory of 4932	4400	1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7.exe	81

C:\Users\Admin\AppData\Local\Temp\1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7.exe
"C:\Users\Admin\AppData\Local\Temp\1c3ff34a927847f718c004f19be84a23882b549ffaf1aa77f87c69b0f3c0a7e7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\Friendster Bruteforce.exe
  "C:\Users\Admin\AppData\Local\Temp\Friendster Bruteforce.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 852
  2⤵
  - Program crash
  PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4400 -ip 4400
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Friendster Bruteforce.exe

Filesize
114KB

MD5
6e86cc4f7eab19bd067fac6b3c955b40

SHA1
a72b9d3b853e899e7e62c0f38f4234655f967d1e

SHA256
0a661ffcfd3daeea0fcce984716db040d41d51d7539f87f9dd65056d0562568a

SHA512
008efcf74fd7eb1a22491452d77a8172b95cdfd6006dc25706fe42ae906529ecce2b24bf3e0cce80ba9ba5a418c49d0144160b0d0fec1a62eaac1e08a648b3b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Friendster Bruteforce.exe

Filesize
114KB

MD5
6e86cc4f7eab19bd067fac6b3c955b40

SHA1
a72b9d3b853e899e7e62c0f38f4234655f967d1e

SHA256
0a661ffcfd3daeea0fcce984716db040d41d51d7539f87f9dd65056d0562568a

SHA512
008efcf74fd7eb1a22491452d77a8172b95cdfd6006dc25706fe42ae906529ecce2b24bf3e0cce80ba9ba5a418c49d0144160b0d0fec1a62eaac1e08a648b3b8

Download Submit
memory/4932-135-0x000000001C100000-0x000000001CB36000-memory.dmp

Filesize
10.2MB

Download
memory/4932-136-0x0000000000D4A000-0x0000000000D4F000-memory.dmp

Filesize
20KB

Download
memory/4932-137-0x0000000000D4A000-0x0000000000D4F000-memory.dmp

Filesize
20KB

Download