Analysis

  • max time kernel
    129s
  • max time network
    78s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 10:44

General

  • Target

    fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe

  • Size

    168KB

  • MD5

    486a4a703fe9733a4f02daa9dc28a7ec

  • SHA1

    25db9e546d07e2b5f40554cd25400c9210d67133

  • SHA256

    fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389

  • SHA512

    a27d523dfd873fcdc9a4402f1d01ca879922f8d95fff2c3d2ccdb3e540cf7cfc15212ec4807dc0da987e707a66566e90e49c181f4750a4dd893315885b061de7

  • SSDEEP

    3072:E1uN9xw7rMv4921HIZp21l2cWOEXyHP2p/LJpgmigZB247vjXLZktwW:RmcQ92lKpCeOEVpznTt7vT

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe
    "C:\Users\Admin\AppData\Local\Temp\fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe
      C:\Users\Admin\AppData\Local\Temp\fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe startC:\Program Files (x86)\LP\015B\C31.exe%C:\Program Files (x86)\LP\015B
      2⤵
        PID:1720
      • C:\Users\Admin\AppData\Local\Temp\fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe
        C:\Users\Admin\AppData\Local\Temp\fa9636517c6ed781cb65e19702d7cddc102edc982207612dd64fc7adeb24e389.exe startC:\Program Files (x86)\D9179\lvvm.exe%C:\Program Files (x86)\D9179
        2⤵
          PID:1020

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1020-65-0x00000000005CB000-0x0000000000646000-memory.dmp

        Filesize

        492KB

      • memory/1020-66-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

      • memory/1708-54-0x0000000075451000-0x0000000075453000-memory.dmp

        Filesize

        8KB

      • memory/1708-55-0x00000000002FB000-0x0000000000376000-memory.dmp

        Filesize

        492KB

      • memory/1708-56-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

      • memory/1708-57-0x00000000002FB000-0x0000000000376000-memory.dmp

        Filesize

        492KB

      • memory/1708-62-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

      • memory/1720-60-0x000000000062B000-0x00000000006A6000-memory.dmp

        Filesize

        492KB

      • memory/1720-61-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB