d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe
Size

2.5MB
MD5

c73567c9249f5b69ccd24af986f8b9b7
SHA1

a8d2985b83a39e73e3d9da3562e5b9c267e04876
SHA256

d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64
SHA512

7ba4280dddfa85926a3c5c37aa4c1f01cb7779031a0e09f2e08a38f1797896de21c58b96304b4e95ef358eeaed63ea9bc9adf28f41e8b044fb9e360385bebd83
SSDEEP

49152:Jj7mXK4zLmlwfnvpHy55J6w+vd4cmhqn4Bz4NMjXvzzysjNMYCdrNkGfg:JjpfwvhQ6w+vdvqpgCSsuBbrfg

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

geek64.exe

pid process

2324 geek64.exe
1272
Loads dropped DLL 1 IoCs

Processes:

d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe

pid process

2356 d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2324	geek64.exe
1272

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x0000000000AE3000-memory.dmp	upx
behavioral1/memory/2356-7-0x0000000000400000-0x0000000000AE3000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

Processes:

geek64.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	geek64.exe
File opened for modification	C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\ShellUI.MST	geek64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exegeek64.exe

pid	process
2356	d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe
2324	geek64.exe
2324	geek64.exe
2324	geek64.exe
2324	geek64.exe
2324	geek64.exe
2324	geek64.exe
2324	geek64.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe

description	pid	process	target process
PID 2356 wrote to memory of 2324	2356	d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe	geek64.exe
PID 2356 wrote to memory of 2324	2356	d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe	geek64.exe
PID 2356 wrote to memory of 2324	2356	d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe	geek64.exe
PID 2356 wrote to memory of 2324	2356	d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe	geek64.exe

C:\Users\Admin\AppData\Local\Temp\d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe
"C:\Users\Admin\AppData\Local\Temp\d324a87e78f9b217353eece75552acf62e2e50624102f231156b4077a7527e64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\geek64.exe
C:\Users\Admin\AppData\Local\Temp\geek64.exe
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\geek64.exe

Filesize
3.7MB

MD5
d044e976eef263ca77366509ebb80970

SHA1
605c1a3fa0bb16cfbd02e46f6c60175ad96038da

SHA256
f1296c5461170bc0b35a862a9a6a9d1584eb56565c50cbb2676a2efa2307efcc

SHA512
addd528c41d4373660a372e8190763e8ae41e0524168cd20e0ce390de28aac297ace8fe8aab2e065093ea1ffe2fb70c4bc19f2bb74faadf4abf67a9d30b04bd1

Download Submit
\Users\Admin\AppData\Local\Temp\geek64.exe

Filesize
3.7MB

MD5
d044e976eef263ca77366509ebb80970

SHA1
605c1a3fa0bb16cfbd02e46f6c60175ad96038da

SHA256
f1296c5461170bc0b35a862a9a6a9d1584eb56565c50cbb2676a2efa2307efcc

SHA512
addd528c41d4373660a372e8190763e8ae41e0524168cd20e0ce390de28aac297ace8fe8aab2e065093ea1ffe2fb70c4bc19f2bb74faadf4abf67a9d30b04bd1

Download Submit
\Users\Admin\AppData\Local\Temp\geek64.exe

Filesize
3.7MB

MD5
d044e976eef263ca77366509ebb80970

SHA1
605c1a3fa0bb16cfbd02e46f6c60175ad96038da

SHA256
f1296c5461170bc0b35a862a9a6a9d1584eb56565c50cbb2676a2efa2307efcc

SHA512
addd528c41d4373660a372e8190763e8ae41e0524168cd20e0ce390de28aac297ace8fe8aab2e065093ea1ffe2fb70c4bc19f2bb74faadf4abf67a9d30b04bd1

Download Submit
memory/2356-0-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download
memory/2356-7-0x0000000000400000-0x0000000000AE3000-memory.dmp

Filesize
6.9MB

Download