8b0d8651e035fcc91c39b3260c871342d1652c97b37c86f07a561828b652e907

Resubmissions

12/04/2023, 07:24

230412-h8elnacc4s 10

23/01/2023, 17:47

230123-wdcepsga5y 10

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2023, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

x.dll
Size

618KB
MD5

57ec0f7cf124d1ae3b73e643a6ac1dad
SHA1

213c548e0a5e3fefe37bb857f0f6e3230d29675c
SHA256

8b0d8651e035fcc91c39b3260c871342d1652c97b37c86f07a561828b652e907
SHA512

e6116ace287aa8ece6a70a516dad7026b719431dc7944c25021df85b47b7cb77bcd5098c1fded6b96295a6aaac6471b4be1deffec8991cbbbadcc8f08b693b82
SSDEEP

12288:bjmmcqPiokJeOweuSQRHJEI2dLBFXkH+MBL:bamcDoOweuRRbc3keMBL

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 396	4880	rundll32.exe	84
PID 4880 wrote to memory of 396	4880	rundll32.exe	84
PID 4880 wrote to memory of 396	4880	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x.dll,#1
  2⤵
  PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads