Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
28-07-2023 22:37
General
-
Target
9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7.exe
-
Size
536KB
-
MD5
ce0d92e0c437b96373597ed18de7324e
-
SHA1
1695af76eda0e99b5159db064557f7c6dbd493c5
-
SHA256
9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7
-
SHA512
75e6f2060c0ec516107c6987763bd90befe6cb65d97aa315d0ddd1f71c80454aed9fe5f96f1bb7e43e57470faf0583028f2562dbc3bbb9cb52f1136fc4b41226
-
SSDEEP
6144:X+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUR:OPw2PjCLe3a6Q70zbYow60R
Malware Config
Signatures
-
PredatorStealer
Predator is a modular stealer written in C#.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7.exe"C:\Users\Admin\AppData\Local\Temp\9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7.exe"1⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\Zip.exe"C:\Users\Admin\AppData\Local\Temp\Zip.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
369KB
MD5cb7722640352101e3e3d5379f71a6f62
SHA1458ee37d6be69c84db82fcfb258b3dca150589b5
SHA25699cb923b582003db90473bdf488aae37ca7be8b920b703d7711204cd4c002e2a
SHA51221b43dfd2347074a83f88f9ec6e9319213267ffb85847ba33c94dfeb9276ba313a1b813815b1a69166f9f52166455cdd211a68b7837b7619c903bcd6a4dfe68b
-
Filesize
2KB
MD5d5628f68c6301a53aaf470e6d5513b28
SHA101dcea142ba4aeb39c4c4eb5a631da0b2d196183
SHA256caa4da8ace2b22ed85c22fa713f69240bb72629ca3a67d4ecca931429f8c7bfc
SHA5129ec7a2e8f48013d519014351ec94f764a867a940e114aeb140ff98a797fcc974122ce2bcca7737e4205b2c6b7155081f79f7d6ca90d3ac41f3327416ca976bb7
-
Filesize
526B
MD538a2dc0e4c132d24ef90ce12daf42e7f
SHA1953850820a7a30ae3fb286c835d20fb1dbf90ac2
SHA25623a3577e2fb9f4644ad22271816af5b35e59692e4e8c7899aee934ebc86746ef
SHA5126306a5851655652156d7fc6c0a4e00e905373b1000e4c105ccef563b860ae2b855cee4bbc4e8fab2e5c8920a3600af2c75f77c46f62c3f00299e73f8a88acffd
-
Filesize
370KB
MD52e3addc5f236e76ba59ca8a898f59bbd
SHA1e0fa4529f4623f7fad0f4b385a1de14772784926
SHA25682ef8c0f7b6467062cb9f5aeae972258a216da23c97173b9bbaa2b11bcd10e09
SHA51293e85648579bbd8a84f75272e5c9fba11ab49f99d019379a37946c490981e0a510a6489078d8cc27ee833359925ce5fbc4cac73b79dcde5e7cb6fe13c5bc7e28
-
Filesize
325B
MD50dd1e9270d612e66e95160f049c54adb
SHA1a682140b400740b1141add293f6c871e93239c71
SHA2560dc16a233ec00200b1cf1a3a841eee764d92d7089a73a6828ac3d4191eb01c40
SHA512af4c75448d31cb56e44a32ecfcd28b58a0d56ffff08a335be9614975b7278dbf407c02d43417f20bbaa45d7e904c40ea3c076a9616aedf64c0e94764ec349ac1
-
Filesize
31KB
MD5af07e88ec22cc90cebfda29517f101b9
SHA1a9e6f4ae24abf76966d7db03af9c802e83760143
SHA2561632fbff8edc50f2c7ef7bb2fe9b2c17e6472094f0d365a98e0dec2a12fa8ec2
SHA512b4575af98071fc8d46c022e24bfb2c1567d7e5f3de0d8fb5fee6f876985c7780a5b145f645725ff27a15367162aa08490ac2f8dd59d705663094fe4e1eeec7bc
-
Filesize
31KB
MD5af07e88ec22cc90cebfda29517f101b9
SHA1a9e6f4ae24abf76966d7db03af9c802e83760143
SHA2561632fbff8edc50f2c7ef7bb2fe9b2c17e6472094f0d365a98e0dec2a12fa8ec2
SHA512b4575af98071fc8d46c022e24bfb2c1567d7e5f3de0d8fb5fee6f876985c7780a5b145f645725ff27a15367162aa08490ac2f8dd59d705663094fe4e1eeec7bc
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
560KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
64KB
-
Filesize
9.9MB
