Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
28-07-2023 22:37
General
-
Target
9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7.exe
-
Size
536KB
-
MD5
ce0d92e0c437b96373597ed18de7324e
-
SHA1
1695af76eda0e99b5159db064557f7c6dbd493c5
-
SHA256
9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7
-
SHA512
75e6f2060c0ec516107c6987763bd90befe6cb65d97aa315d0ddd1f71c80454aed9fe5f96f1bb7e43e57470faf0583028f2562dbc3bbb9cb52f1136fc4b41226
-
SSDEEP
6144:X+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWdG/Wow7+JJUR:OPw2PjCLe3a6Q70zbYow60R
Malware Config
Signatures
-
PredatorStealer
Predator is a modular stealer written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7.exe"C:\Users\Admin\AppData\Local\Temp\9f2a970442b3b9551f3fc534f19b989cb24c652ca5ac2e4eea515ac6b91bf0b7.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\Zip.exe"C:\Users\Admin\AppData\Local\Temp\Zip.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD59285c0c95ddcdc3e037f78f7a8a6dba5
SHA1d6433fe4c75d7c2600b29cb3eefacbbfeeee29cc
SHA2565fbeb5640a98f216f9cd577e3936e6a75e1ad0d06da2a42f032939c227a58031
SHA5126fe27a6230a6df403183118e616f44d1e92c0b97a056af5b3487d029e2abb5ee2ec07ca3490c89318905ce536b30854e18e0d0af9f98d316e42d4ba1b124aae9
-
Filesize
1KB
MD52554617f5ea5199193845737e7e7d8f7
SHA1f554ce7419f1f4c1696d6b8d8288791ac85b1aa2
SHA256dad01264f26c2236215a3e45b92fe83fb08e3406b1b121958d0e9c3df4c0ae34
SHA5127444900f9a771bec90f7478714581bce47fe2b398c73ce1b5cc442dc123494388b7d79892955bec1bfcebec05a4562cc4522ededecfa99218990878f9ffc3898
-
Filesize
1KB
MD5ec8bcb133f1440d57aeba7649b588c8c
SHA130f51ceb53d9044da75df937d2ff23d34f246e39
SHA256a46a69d91ea545d22afd09af7aa0bb2814c9d7181ef487e526908612a155a96e
SHA5129be57597b6a9f0f07a1b62605dd7de7cb161e96e984090256a3fd8c129d1cb2afe8d979f5460f4005b1478e91da0dcf92b314522eab049afb7cea7149fe101b2
-
Filesize
419KB
MD5dd9477ff91f8341c4544058726edde6a
SHA1c5ba52bc57f215b2dc867236a8fb6f66e3285bdc
SHA25625c57064e7f6bdde894fb72c9b25619e825c7ae91209d6b4cd0001e519018f5e
SHA5123bfc4e4ff51ce212e0d49864481a419c3679f8a24ea8a79d4a757ce03d15ded564c7c9aebedae6020f47014981c12ce7df0a35f7bb1dc9bd6230b1234433c39b
-
Filesize
315B
MD5141c27ca53da38c2ca0e744c5ebf9322
SHA1a35b9043c1f8027f5ac1662877608f2374c94751
SHA256f17376c17d1d10fd12e622371216b3b83cbec5120c023990f5dd939f9f57c37e
SHA512e578e547694ed5fc294ed530293cac83326c50ae1e0a6ef5034baa679723cb803f1cc5a91527aa8c18b406bf50050a9b05ad3ec83c1e77d945e642592c1d6982
-
Filesize
31KB
MD5af07e88ec22cc90cebfda29517f101b9
SHA1a9e6f4ae24abf76966d7db03af9c802e83760143
SHA2561632fbff8edc50f2c7ef7bb2fe9b2c17e6472094f0d365a98e0dec2a12fa8ec2
SHA512b4575af98071fc8d46c022e24bfb2c1567d7e5f3de0d8fb5fee6f876985c7780a5b145f645725ff27a15367162aa08490ac2f8dd59d705663094fe4e1eeec7bc
-
Filesize
31KB
MD5af07e88ec22cc90cebfda29517f101b9
SHA1a9e6f4ae24abf76966d7db03af9c802e83760143
SHA2561632fbff8edc50f2c7ef7bb2fe9b2c17e6472094f0d365a98e0dec2a12fa8ec2
SHA512b4575af98071fc8d46c022e24bfb2c1567d7e5f3de0d8fb5fee6f876985c7780a5b145f645725ff27a15367162aa08490ac2f8dd59d705663094fe4e1eeec7bc
-
Filesize
31KB
MD5af07e88ec22cc90cebfda29517f101b9
SHA1a9e6f4ae24abf76966d7db03af9c802e83760143
SHA2561632fbff8edc50f2c7ef7bb2fe9b2c17e6472094f0d365a98e0dec2a12fa8ec2
SHA512b4575af98071fc8d46c022e24bfb2c1567d7e5f3de0d8fb5fee6f876985c7780a5b145f645725ff27a15367162aa08490ac2f8dd59d705663094fe4e1eeec7bc
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
560KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
