24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161

Resubmissions

10-08-2023 13:02

230810-p92wxach32 8

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2023 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe
Size

419KB
MD5

d811a57bc0e8b86b449277f9ffb50cc9
SHA1

cdab34eea2dfd5e96412e34c0b3eb090a9661377
SHA256

24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161
SHA512

5b569f0cebdc006125ac37ee0e333a22a35189214b5c2ab05671e7c307936c1d121a9afd7c48ce5283435c755d82110ce70adffd4e20570c3d4f4680962a7dfa
SSDEEP

12288:ZvtSEEuEE3EEMEEzEE5EEOEEmEEAEE2EE6EE3EERhXz+MbfR1nYm4BJ1B4ywtT5m:Zvtk

Score

8^/10

spyware stealer

Malware Config

Signatures

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

Processes:

24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe

pid	process
3032	24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe
3032	24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe
3032	24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe

pid process

3032 24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe

description pid process

Token: SeDebugPrivilege 3032 24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe

flow	ioc
14	ip-api.com

description	pid	process
Token: SeDebugPrivilege	3032	24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe

C:\Users\Admin\AppData\Local\Temp\24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe
"C:\Users\Admin\AppData\Local\Temp\24bd790bc9427021121ec0e318db93369c2d893e40309f7083f178d3a5819161.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll
Filesize
384KB

MD5
55c797383dbbbfe93c0fe3215b99b8ec

SHA1
1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

SHA256
5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

SHA512
648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll
Filesize
384KB

MD5
55c797383dbbbfe93c0fe3215b99b8ec

SHA1
1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

SHA256
5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

SHA512
648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

Download Submit
C:\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll
Filesize
1.3MB

MD5
8be215abf1f36aa3d23555a671e7e3be

SHA1
547d59580b7843f90aaca238012a8a0c886330e6

SHA256
83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae

SHA512
38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b

Download Submit
memory/3032-137-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/3032-135-0x0000000004CB0000-0x0000000004CCA000-memory.dmp

Filesize
104KB

Download
memory/3032-138-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Filesize
408KB

Download
memory/3032-147-0x0000000006290000-0x0000000006322000-memory.dmp

Filesize
584KB

Download
memory/3032-148-0x0000000006210000-0x0000000006222000-memory.dmp

Filesize
72KB

Download
memory/3032-149-0x0000000006600000-0x00000000067C2000-memory.dmp

Filesize
1.8MB

Download
memory/3032-136-0x0000000005280000-0x0000000005824000-memory.dmp

Filesize
5.6MB

Download
memory/3032-133-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/3032-153-0x0000000006980000-0x00000000069E2000-memory.dmp

Filesize
392KB

Download
memory/3032-134-0x0000000000330000-0x00000000003A0000-memory.dmp

Filesize
448KB

Download
memory/3032-159-0x0000000006E80000-0x0000000006EBC000-memory.dmp

Filesize
240KB

Download
memory/3032-170-0x0000000007CB0000-0x0000000007D26000-memory.dmp

Filesize
472KB

Download
memory/3032-171-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/3032-176-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download