Analysis
-
max time kernel
161s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
03-08-2023 07:22
General
-
Target
.............exe
-
Size
3.9MB
-
MD5
1c9d03acc5ce4d1565e01418e2892087
-
SHA1
345be215d0017d06a3934150105389730038fa69
-
SHA256
bdb03d50cba10bbbaea2409521c515d15f3e674e6ccabbadfec319bdc08cd1ea
-
SHA512
1442ad0b3af4fddc1c6980426a25f6d2c4b033902b8cc42596ad0077385ca3d56e4fed4517a61fe4d5b5b185b34030196ac9c5dcc61d93fd48292aed2b7998e8
-
SSDEEP
49152:gnHn5pXUXb6c9YuoHjAbDiYFpIDckO4iNQxgei6HQR9sXafgkDFMVR9C1UhPJXMS:45pEXOc9AH8FpQrDgeJrBiCV2HXq
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 46 IoCs
-
Suspicious use of SendNotifyMessage 46 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\.............exe"C:\Users\Admin\AppData\Local\Temp\.............exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd25945225145993\bootstrap_6794.htmlFilesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
C:\Users\Admin\AppData\Local\Temp\nsd25945225145993\css\main.cssFilesize
6KB
MD59b27e2a266fe15a3aabfe635c29e8923
SHA1403afe68c7ee99698c0e8873ce1cd424b503c4c8
SHA256166aa42bc5216c5791388847ae114ec0671a0d97b9952d14f29419b8be3fb23f
SHA5124b07c11db91ce5750d81959c7b2c278ed41bb64c1d1aa29da87344c5177b8eb82d7d710b426f401b069fd05062395655d985ca031489544cdf9b72fe533afa61
-
C:\Users\Admin\AppData\Local\Temp\nsd25945225145993\images\Loader.gifFilesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
\Users\Admin\AppData\Local\Temp\Fusion_ld\Fusion.dllFilesize
1011KB
MD57d900a78879abc427d67533fea28a2bb
SHA1db0632d5db8edc354922b32c5b948eac44a86fdc
SHA256b4eba257269060b9ee20c0c24d943d31d81a6da7b26c33c2ffac311a977d5404
SHA512af35d6f02d92c76913a2787df1b4f6f1f7800ad4ed1d7c692b270b2a576e991675df75932995fd1136a9ab4f6911325be4cc2733b7304546fd4a87c75fd38b73
-
memory/2036-372-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2036-371-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2036-369-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2036-368-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2344-334-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-344-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-310-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/2344-312-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-305-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-316-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-319-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-323-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-325-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-326-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-67-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-324-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-56-0x0000000003E90000-0x0000000003F92000-memory.dmpFilesize
1.0MB
-
memory/2344-335-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-336-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-65-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-342-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-309-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-345-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-346-0x0000000003E90000-0x0000000003F92000-memory.dmpFilesize
1.0MB
-
memory/2344-347-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-348-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-349-0x00000000053B0000-0x0000000005494000-memory.dmpFilesize
912KB
-
memory/2344-350-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-351-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-352-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-353-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-354-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-355-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/2344-66-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-63-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-58-0x0000000005970000-0x0000000005B7C000-memory.dmpFilesize
2.0MB
-
memory/2344-59-0x00000000053B0000-0x0000000005494000-memory.dmpFilesize
912KB
