Analysis

  • max time kernel
    162s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2023 20:51

General

  • Target

    3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe

  • Size

    5.0MB

  • MD5

    8a975def696d44a9cecb461dc934f7e2

  • SHA1

    c762cde11f51098403c32fb93d6cbf3281636b38

  • SHA256

    3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd

  • SHA512

    ccfd8860bc17438a1be89d5db8b69160839cb70d6f7564972895d5b6d21c3d725363f1d55a5d6eee5538e52b48b65b05760eddc4fded03b7c7f4464500d0dde9

  • SSDEEP

    98304:L6RXf8WZCk7b0c+BL58aKsJOQ7lk5gOXIAoNaoX4/fb:Lgv8WZd7bA5FnlEgOXBts4

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe
    "C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe
      "C:\Users\Admin\AppData\Local\Temp\3e2bfb376b8fe77a05fc44e82cbdc9d065cbc5cd6aacb7c261227ed40fa153cd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 260
        3⤵
        • Program crash
        • Suspicious behavior: GetForegroundWindowSpam
        PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ose00000.exe

    Filesize

    150KB

    MD5

    991bc55f6bf63babf15d917efef035f3

    SHA1

    00337969921bc03d000bfa8aed670e81d84c1b33

    SHA256

    ad6be6efd19f3c886da10bf3a7b9eaa8d636b25b7b7e77a7be514e0ec50d02cb

    SHA512

    00752c136f3816d3dbc0e0051a6ae15dba30f3a1d1ad60371ed81e1ba49c9ffea3a54d2ab1a6cba488dc1ae6ddf9bf2e7b166878db7093a02dc2e8f224828edb

  • memory/1196-2-0x0000000000A20000-0x000000000112A000-memory.dmp

    Filesize

    7.0MB

  • memory/3044-5-0x0000000000450000-0x0000000000451000-memory.dmp

    Filesize

    4KB

  • memory/3044-6-0x0000000000450000-0x0000000000451000-memory.dmp

    Filesize

    4KB

  • memory/3044-7-0x0000000000450000-0x0000000000451000-memory.dmp

    Filesize

    4KB

  • memory/3048-0-0x0000000000A20000-0x000000000112A000-memory.dmp

    Filesize

    7.0MB

  • memory/3048-1-0x0000000002530000-0x0000000002C3A000-memory.dmp

    Filesize

    7.0MB

  • memory/3048-3-0x0000000002530000-0x0000000002C3A000-memory.dmp

    Filesize

    7.0MB