Overview

overview

10

Static

static

3

NEAS.50e8e...JC.exe

windows7-x64

10

NEAS.50e8e...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    24/10/2023, 19:54 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe

  • Size

    935KB

  • MD5

    2e450823db1430464efb84f8074cc84f

  • SHA1

    88c86734e5de9f22154ca8c55cd141b2068e922f

  • SHA256

    50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8fe

  • SHA512

    20c2eedba61f776d90636ad6dae668ad9222c5eca9a69437587317321e3116591250b8327fd41079f892ef021fc7d37035dd1fb20617d2c8331fdab376973c2b

  • SSDEEP

    24576:UpCvo/Sfhf/+5SxYn89JnMKFpn/9IUI7ighRKA2E4jKk:iX2f/LxYnonMKHn/9K71hRjrq

Score
10/10
predatorstealercollectiondiscoverypersistencespywarestealer

Malware Config

Signatures

  • PredatorStealer

    Predator is a modular stealer written in C#.

    stealerpredatorstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LUHgPxjH.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LUHgPxjH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D19.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2756
    • C:\Users\Admin\AppData\Local\Temp\NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe"
      2⤵
        PID:2200
      • C:\Users\Admin\AppData\Local\Temp\NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe"
        2⤵
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:2876
        • C:\Users\Admin\AppData\Local\Temp\Zip.exe
          "C:\Users\Admin\AppData\Local\Temp\Zip.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1736

    Network

    • flag-us
      DNS
      ip-api.com
      Zip.exe
      Remote address:
      8.8.8.8:53
      Request
      ip-api.com
      IN A
      Response
      ip-api.com
      IN A
      208.95.112.1
    • flag-us
      GET
      http://ip-api.com/json/
      NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /json/ HTTP/1.1
      Host: ip-api.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Tue, 24 Oct 2023 19:56:13 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 323
      Access-Control-Allow-Origin: *
      X-Ttl: 35
      X-Rl: 38
    • flag-us
      GET
      http://ip-api.com/json/
      NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /json/ HTTP/1.1
      Host: ip-api.com
      Response
      HTTP/1.1 200 OK
      Date: Tue, 24 Oct 2023 19:56:15 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 323
      Access-Control-Allow-Origin: *
      X-Ttl: 32
      X-Rl: 37
    • flag-us
      GET
      http://ip-api.com/json/
      NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /json/ HTTP/1.1
      Host: ip-api.com
      Response
      HTTP/1.1 200 OK
      Date: Tue, 24 Oct 2023 19:56:18 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 323
      Access-Control-Allow-Origin: *
      X-Ttl: 30
      X-Rl: 36
    • flag-us
      GET
      http://ip-api.com/json/
      Zip.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /json/ HTTP/1.1
      Host: ip-api.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Tue, 24 Oct 2023 19:56:23 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 323
      Access-Control-Allow-Origin: *
      X-Ttl: 25
      X-Rl: 35
    • flag-us
      GET
      http://ip-api.com/json/
      Zip.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /json/ HTTP/1.1
      Host: ip-api.com
      Response
      HTTP/1.1 200 OK
      Date: Tue, 24 Oct 2023 19:56:25 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 323
      Access-Control-Allow-Origin: *
      X-Ttl: 23
      X-Rl: 34
    • flag-us
      GET
      http://ip-api.com/json/
      Zip.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /json/ HTTP/1.1
      Host: ip-api.com
      Response
      HTTP/1.1 200 OK
      Date: Tue, 24 Oct 2023 19:56:26 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 323
      Access-Control-Allow-Origin: *
      X-Ttl: 22
      X-Rl: 33
    • 208.95.112.1:80
      http://ip-api.com/json/
      http
      NEAS.50e8e741266264cb161b567f8dbcd65bf8cdcfea296c9807dc00a9cae853b8feexe_JC.exe
      549 B
       1.8kB
       9
      6

      HTTP Request

      GET http://ip-api.com/json/

      HTTP Response

      200

      HTTP Request

      GET http://ip-api.com/json/

      HTTP Response

      200

      HTTP Request

      GET http://ip-api.com/json/

      HTTP Response

      200
    • 208.95.112.1:80
      http://ip-api.com/json/
      http
      Zip.exe
      549 B
       1.7kB
       9
      5

      HTTP Request

      GET http://ip-api.com/json/

      HTTP Response

      200

      HTTP Request

      GET http://ip-api.com/json/

      HTTP Response

      200

      HTTP Request

      GET http://ip-api.com/json/

      HTTP Response

      200
    • 8.8.8.8:53
      ip-api.com
      dns
      Zip.exe
      56 B
       72 B
       1
      1

      DNS Request

      ip-api.com

      DNS Response

      208.95.112.1

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\NL_BFEBFBFF000206D7\Files\desktop.ini
      Filesize

      282B

      MD5

      9e36cc3537ee9ee1e3b10fa4e761045b

      SHA1

      7726f55012e1e26cc762c9982e7c6c54ca7bb303

      SHA256

      4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026

      SHA512

      5f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NL_BFEBFBFF000206D7\ProgramList.txt
      Filesize

      4KB

      MD5

      ffa713514357da41366480604e20e8b3

      SHA1

      a674b688006ce32f8c49ea0c5067ed03c8694e04

      SHA256

      41b448cff8bba381ac27892377d4592bbf221645c933b8255fabd123e03b67b1

      SHA512

      4c8492125d6158a8315e0eb2f7cff2f41e189b01318c5a3c1198f2aff293ad10846ff5eebba6990019beb2472aa85520a97c0a5e83836b93771ccc8f8f85a3f0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NL_BFEBFBFF000206D7\ProsessList.txt
      Filesize

      556B

      MD5

      f4f30dacf35ab2560e7ccc7ccd428a7d

      SHA1

      c23736ca8a559951ebefd4ea28999b4c3c66215f

      SHA256

      c31f18c5c825c03a9cf29a833903faef69987da2eca12a5099962815687a535d

      SHA512

      98a4121802476a57cd1afa137230909a953b5da47669ed0b28abc2799c328ec80e5472e642a02a9b84dbb2d53263cd8e60a4b524d6d350843b18f1ccaf895b09

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NL_BFEBFBFF000206D7\Screenshot.png
      Filesize

      383KB

      MD5

      88dfccefb9e576e4725a458a5a3cf027

      SHA1

      12c85f7b7e5db819e96ebd78459ea630cafc1bfe

      SHA256

      ef2b47cff14756cdf8bfe912a8cf5bfa1c25354cf452813bc51ca27b51bd8527

      SHA512

      a3ec64733e5720fd407a6e070493e9e6c0bbd2fc75492464590154b65fb7d2ffaa47a1565b361845a2ad4b0e35e3acc2d80c17f0cbc263627c8a1da24826a96f

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\NL_BFEBFBFF000206D7\info.txt
      Filesize

      325B

      MD5

      2365e08232be6eb66e7dc5c985a1dbc2

      SHA1

      79d994456b8c9c73da1bd79a038e8d1529614db4

      SHA256

      be92762570f373f776835abcb546ea8264505f9bd5dc732e79fdc414e5089efe

      SHA512

      33a258957774db27087a239ac1c0ff4edcc49d6549923f47fad91e2f367f3fce92b4379234ff348bc74390a1dfc4e29ee305dc42a986006d175201f4bd3eed25

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Zip.exe
      Filesize

      31KB

      MD5

      3afd64484a2a34fc34d1155747dd3847

      SHA1

      451e1d878179f6fcfbaf9fa79d9ee8207489748f

      SHA256

      bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9

      SHA512

      d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Zip.exe
      Filesize

      31KB

      MD5

      3afd64484a2a34fc34d1155747dd3847

      SHA1

      451e1d878179f6fcfbaf9fa79d9ee8207489748f

      SHA256

      bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9

      SHA512

      d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp2D19.tmp
      Filesize

      1KB

      MD5

      ff69ca8f56b84bce3adabd1aae9c1508

      SHA1

      b400009520baa6fa7f0357bce80324a221428b9d

      SHA256

      c611fca0bf7e2050381ef14ca0fe68e56b4240b423cb16190918bebb1db69386

      SHA512

      9c38770f8b633b39cb288c7e2c16f27882f6c84bee5659c290e29e3a779226adf1d6911b359a0c24a9f6678ea1867bbc526840b542ede82fe536e19ae02b3e1e

      Download Submit

    • \Users\Admin\AppData\Local\Temp\Zip.exe
      Filesize

      31KB

      MD5

      3afd64484a2a34fc34d1155747dd3847

      SHA1

      451e1d878179f6fcfbaf9fa79d9ee8207489748f

      SHA256

      bf78263914c6d3f84f825504536338fadd15868d788bf30d30613ca27abeb7a9

      SHA512

      d21a519c8867d569e56ac5c93ce861a72f6853e3a959467bf8e8779664f99b5e8be76ad27e078935191c798aea05891960e01d9a0d52e2a33d34ec5a58c00448

      Download Submit

    • memory/1736-61-0x000000001B1A0000-0x000000001B220000-memory.dmp

      Filesize

      512KB

      Download

    • memory/1736-56-0x0000000001370000-0x0000000001380000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1736-68-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1736-57-0x000007FEF5070000-0x000007FEF5A5C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1736-59-0x000000001B1A0000-0x000000001B220000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2520-4-0x0000000073DF0000-0x00000000744DE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2520-3-0x0000000000500000-0x0000000000516000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2520-5-0x0000000004890000-0x00000000048D0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2520-6-0x0000000000560000-0x0000000000570000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2520-31-0x0000000073DF0000-0x00000000744DE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2520-7-0x00000000058B0000-0x000000000597A000-memory.dmp

      Filesize

      808KB

      Download

    • memory/2520-2-0x0000000004890000-0x00000000048D0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2520-1-0x0000000073DF0000-0x00000000744DE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2520-0-0x0000000000E80000-0x0000000000F6E000-memory.dmp

      Filesize

      952KB

      Download

    • memory/2820-36-0x0000000000380000-0x00000000003C0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2820-34-0x000000006E3D0000-0x000000006E97B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2820-39-0x000000006E3D0000-0x000000006E97B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2820-38-0x0000000000380000-0x00000000003C0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2820-33-0x000000006E3D0000-0x000000006E97B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/2876-58-0x00000000006B0000-0x00000000006F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2876-29-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-37-0x0000000072DB0000-0x000000007349E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2876-55-0x0000000072DB0000-0x000000007349E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2876-46-0x00000000006B0000-0x00000000006F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2876-32-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-40-0x00000000006B0000-0x00000000006F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2876-35-0x00000000006B0000-0x00000000006F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2876-60-0x00000000006B0000-0x00000000006F0000-memory.dmp

      Filesize

      256KB

      Download

    • memory/2876-27-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2876-23-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-21-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-19-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-17-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    • memory/2876-15-0x0000000000400000-0x0000000000490000-memory.dmp

      Filesize

      576KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.