Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2023 19:48
Behavioral task
behavioral1
Sample
dbc38af1946d3ce853119aa8bf478e30_exe32.exe
Resource
win7-20230831-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
dbc38af1946d3ce853119aa8bf478e30_exe32.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
dbc38af1946d3ce853119aa8bf478e30_exe32.exe
-
Size
909KB
-
MD5
dbc38af1946d3ce853119aa8bf478e30
-
SHA1
f466e5cc5deb673471cd782b58a94a54e72e322c
-
SHA256
eb95923f6eabbd09fcbda998665859ad09caa903da956a449b2aeb7d162372ae
-
SHA512
145e23097362797fb6f4e16fa25eb934b8b62ac4f77c481610ac2ac0ae15e0c071bcd6ebbc6422028c749487049e791c36417d97d7bf302e9406be358bd2acd0
-
SSDEEP
24576:YoFPxcpduABL8rNFTfa9X0dizfHrcBpjbK:XjGuABL8r/oEdizfH8pjbK
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation dbc38af1946d3ce853119aa8bf478e30_exe32.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1268-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1268-4-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x00060000000230c4-7.dat upx behavioral2/memory/3188-13-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2092-15-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5056-16-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3188-17-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2092-20-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/5056-23-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\X: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\E: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\H: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\N: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\Q: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\S: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\M: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\R: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\V: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\A: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\G: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\I: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\K: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\L: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\Z: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\B: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\T: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\J: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\O: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\P: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\U: dbc38af1946d3ce853119aa8bf478e30_exe32.exe File opened (read-only) \??\Y: dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese action lingerie catfight feet wifey .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SysWOW64\config\systemprofile\russian horse lingerie hot (!) cock stockings .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\System32\DriverStore\Temp\japanese action blowjob big titts (Kathrin,Janette).mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SysWOW64\FxsTmp\chinese gay lesbian girly .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SysWOW64\IME\SHARED\black cum xxx sleeping hole .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish horse trambling [milf] hole leather (Curtney).mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian cum fucking voyeur glans upskirt (Sarah).zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\hardcore big hole fishy .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Google\Temp\japanese animal lesbian [bangbus] titts .rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Google\Update\Download\horse sleeping glans redhair .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Microsoft Office\root\Templates\bukkake [milf] black hairunshaved .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian animal sperm [milf] cock .mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Microsoft Office\Updates\Download\american fetish xxx hot (!) 50+ .mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fucking catfight .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Microsoft\Temp\tyrkish horse gay [bangbus] feet penetration .rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Common Files\microsoft shared\italian gang bang xxx [bangbus] 40+ .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fucking masturbation cock pregnant (Sylvia).mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\danish action hardcore full movie fishy .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\swedish porn blowjob lesbian gorgeoushorny .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\bukkake full movie balls .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\bukkake [milf] blondie .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian handjob blowjob catfight cock stockings (Sarah).avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\russian cumshot sperm public leather .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\indian fetish bukkake [milf] glans .rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\indian beastiality beast big titts gorgeoushorny (Curtney).zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese fetish bukkake [bangbus] femdom .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\CbsTemp\tyrkish handjob beast masturbation castration .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\bukkake full movie black hairunshaved (Britney,Janette).mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\gay full movie granny .mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\italian horse trambling hot (!) mature .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\italian handjob beast [milf] (Melissa).mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\bukkake lesbian .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\security\templates\russian fetish xxx girls hole .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\lingerie girls (Melissa).rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish porn sperm public redhair .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\mssrv.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\InputMethod\SHARED\sperm masturbation titts beautyfull .mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\PLA\Templates\trambling girls cock fishy (Sylvia).rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\black action hardcore public hole .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\lesbian lesbian (Sylvia).mpeg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lingerie girls hole .avi.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\assembly\tmp\bukkake girls circumcision (Sonja,Samantha).rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\xxx voyeur pregnant (Ashley,Sylvia).rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\russian action xxx full movie feet black hairunshaved .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\Downloaded Program Files\xxx catfight 40+ .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lesbian girls granny .rar.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\italian nude gay uncut .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\assembly\temp\swedish porn blowjob full movie (Samantha).mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SoftwareDistribution\Download\bukkake uncut fishy .zip.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\beast [bangbus] .mpg.exe dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 5056 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 2092 dbc38af1946d3ce853119aa8bf478e30_exe32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1268 wrote to memory of 3188 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 85 PID 1268 wrote to memory of 3188 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 85 PID 1268 wrote to memory of 3188 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 85 PID 1268 wrote to memory of 2092 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 86 PID 1268 wrote to memory of 2092 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 86 PID 1268 wrote to memory of 2092 1268 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 86 PID 3188 wrote to memory of 5056 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 87 PID 3188 wrote to memory of 5056 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 87 PID 3188 wrote to memory of 5056 3188 dbc38af1946d3ce853119aa8bf478e30_exe32.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056
-
-
-
C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"C:\Users\Admin\AppData\Local\Temp\dbc38af1946d3ce853119aa8bf478e30_exe32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\russian cumshot sperm public leather .zip.exe
Filesize1.5MB
MD519b5ab6cf15130ab482df2cbafe1d5b6
SHA16424c996aa2f96a0d982de16493a0dcc26877fa7
SHA25652dd900b26180011c69df86a094cbccae1ea8ff03d6d983bda7ceea72c747d3f
SHA512af7f8e4bcf4bb0e9c1741deb63525eb7316328fda45d6780117994469be6ff22e001c5a9332dc22e362dec66ca785536cc58bf77e29c3680102bc7a2305bd367