Analysis
-
max time kernel
162s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 20:51
Static task
static1
Behavioral task
behavioral1
Sample
3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe
Resource
win10v2004-20230915-en
General
-
Target
3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe
-
Size
5.0MB
-
MD5
8a975def696d44a9cecb461dc934f7e2
-
SHA1
c762cde11f51098403c32fb93d6cbf3281636b38
-
SHA256
3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd
-
SHA512
ccfd8860bc17438a1be89d5db8b69160839cb70d6f7564972895d5b6d21c3d725363f1d55a5d6eee5538e52b48b65b05760eddc4fded03b7c7f4464500d0dde9
-
SSDEEP
98304:L6RXf8WZCk7b0c+BL58aKsJOQ7lk5gOXIAoNaoX4/fb:Lgv8WZd7bA5FnlEgOXBts4
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Serverx.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\7-Zip\7z.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3044 1196 WerFault.exe 27 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 WerFault.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 3048 wrote to memory of 1196 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 27 PID 1196 wrote to memory of 3044 1196 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 28 PID 1196 wrote to memory of 3044 1196 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 28 PID 1196 wrote to memory of 3044 1196 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 28 PID 1196 wrote to memory of 3044 1196 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 28 PID 3048 wrote to memory of 3044 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 28 PID 3048 wrote to memory of 3044 3048 3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe"C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe"C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 2603⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
PID:3044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD5991bc55f6bf63babf15d917efef035f3
SHA100337969921bc03d000bfa8aed670e81d84c1b33
SHA256ad6be6efd19f3c886da10bf3a7b9eaa8d636b25b7b7e77a7be514e0ec50d02cb
SHA51200752c136f3816d3dbc0e0051a6ae15dba30f3a1d1ad60371ed81e1ba49c9ffea3a54d2ab1a6cba488dc1ae6ddf9bf2e7b166878db7093a02dc2e8f224828edb