Analysis

  • max time kernel
    118s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2023, 19:03

General

  • Target

    80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe

  • Size

    687KB

  • MD5

    bd2c23cfe509ca437b7283734a2d5d43

  • SHA1

    29becf6bcdce7dc8ee39819d41c1dd887a29f50b

  • SHA256

    80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15

  • SHA512

    f45cb5ba8b16398406550b79a7e2af3afa252317557ee53664f6017e84873df86325c177bd20fe621cc8dcd136ca1449dfcb3003dfe7b3d15ea1679ceef94f47

  • SSDEEP

    12288:HymHFFDuK6UH/5hrPuqHvoaAjp25OBH6FD3hCPBXW:SmXur8r2+vNA2OBa8BXW

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    cp5ua.hyperhost.ua
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7213575aceACE@#$

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe"
      2⤵
        PID:2840
      • C:\Users\Admin\AppData\Local\Temp\80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\80dd6624e723c71bda0bb04573a1e96662184bd5dbef76c824c884df8afa2e15_JC.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Cab13E0.tmp

      Filesize

      62KB

      MD5

      3ac860860707baaf32469fa7cc7c0192

      SHA1

      c33c2acdaba0e6fa41fd2f00f186804722477639

      SHA256

      d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

      SHA512

      d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    • C:\Users\Admin\AppData\Local\Temp\Tar1441.tmp

      Filesize

      164KB

      MD5

      4ff65ad929cd9a367680e0e5b1c08166

      SHA1

      c0af0d4396bd1f15c45f39d3b849ba444233b3a2

      SHA256

      c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

      SHA512

      f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    • memory/2024-73-0x0000000073FE0000-0x00000000746CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2024-56-0x00000000004D0000-0x00000000004E4000-memory.dmp

      Filesize

      80KB

    • memory/2024-57-0x0000000073FE0000-0x00000000746CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2024-58-0x0000000004F50000-0x0000000004F90000-memory.dmp

      Filesize

      256KB

    • memory/2024-59-0x0000000000550000-0x000000000055E000-memory.dmp

      Filesize

      56KB

    • memory/2024-60-0x0000000006090000-0x000000000610E000-memory.dmp

      Filesize

      504KB

    • memory/2024-54-0x0000000073FE0000-0x00000000746CE000-memory.dmp

      Filesize

      6.9MB

    • memory/2024-55-0x0000000004F50000-0x0000000004F90000-memory.dmp

      Filesize

      256KB

    • memory/2024-53-0x0000000000910000-0x00000000009C2000-memory.dmp

      Filesize

      712KB

    • memory/2968-71-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2968-67-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-74-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-65-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-76-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-77-0x0000000074650000-0x0000000074D3E000-memory.dmp

      Filesize

      6.9MB

    • memory/2968-78-0x00000000048C0000-0x0000000004900000-memory.dmp

      Filesize

      256KB

    • memory/2968-63-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-61-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2968-113-0x0000000074650000-0x0000000074D3E000-memory.dmp

      Filesize

      6.9MB

    • memory/2968-114-0x00000000048C0000-0x0000000004900000-memory.dmp

      Filesize

      256KB