Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
22-06-2023 09:43
General
-
Target
iexplore.exe
-
Size
352KB
-
MD5
95cdb3027de236e33d32fff9a3786c2f
-
SHA1
173b3dcac22e92a272a8ce228730072b4339e2ce
-
SHA256
33d29e4ca7eefcd1df148075c8765de6bd941faccbd2a1c5219d11cc5193fd68
-
SHA512
ce25b51ddf5fc187ab438dc51e2bab97ba41903087ba8308c7fb3a3f627bc9cc17f58cd5be1b40e3eee7f3fe68b688644ffef08d0e6a09e6d35c6b8c21278708
-
SSDEEP
6144:YZZC6Tf4RnqqfjkKlirFC1jGVr9nOhKy0zIBd6CiBP0PfL+eDHSVJs0z9LjS7g:ONTwxIKlirY1jAy0MjPi2Pj+oA/2
Malware Config
Signatures
-
Detect WinDealer information stealer 15 IoCs
-
WinDealer
WinDealer is an info stealer used by LuoYu group.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\iexplore.exe"C:\Users\Admin\AppData\Local\Temp\iexplore.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5c8034a9882c2d012bf887d12f57219b5
SHA1317a1e6bd6b2a3ed1e430bdd0600e7dc107dacd3
SHA256259a9b41c6fea940108068d0521d0bbad4f0a3ae891e48cc7c9600d1122d2536
SHA51254c92480ad303dcafbf25b8965b24c98f4ab4d34b56d4c0a5269d87c5538bcf3d84e42666f99d9f292d95168c8012c2309582976e28035a3f515f7f62ef4bfda
-
Filesize
121B
MD5ae4e49f673041b57e7ed1bb3e2b4bef5
SHA15baa916f46d2f8e6cd678ba39dab98169b97aece
SHA256b12a63fe4d2a784b2f1a292a48f70de59997ba4a70338f3c6b107e9cc60ce3a1
SHA5129a4d3ff5ba4c3a046a93131c1ef6a57002acccba8636948c87cccb95faf07d78889cd112dbbc53b8b05c879985fa814ecddc8be8f959110ccab39befda24b957
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB