c33c79018a633d26f4c4d780ff49aec28a560dd65941845b060bde1f109d97e0

Analysis

max time kernel
127s
max time network
135s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
04/11/2023, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c33c79018a633d26f4c4d780ff49aec28a560dd65941845b060bde1f109d97e0.dll
Size

1.2MB
MD5

87afe769b56545d60ae5e27f11be382c
SHA1

5978ff469f192a4e290a5a34c01192bfb7371df2
SHA256

c33c79018a633d26f4c4d780ff49aec28a560dd65941845b060bde1f109d97e0
SHA512

ff4c3634e977a1a3eeb1c5e1825c223ab85a28a723d04e18b711f4c3863655fba18c98d36a0948988af390b7c490f5557d6ea64b9f3a9f1f8444ec420acd496e
SSDEEP

24576:oAwtSMdHL4+3MQL+RoZk9LZ/zedfjMTUmXbc5Pf8VB3rsx:gc+3MQLQoZyZ/zEfc6P0f

Score

8^/10

spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	600	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
600	rundll32.exe
600	rundll32.exe
600	rundll32.exe
600	rundll32.exe
600	rundll32.exe
600	rundll32.exe
600	rundll32.exe
600	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 304	600	rundll32.exe	71
PID 600 wrote to memory of 304	600	rundll32.exe	71

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c33c79018a633d26f4c4d780ff49aec28a560dd65941845b060bde1f109d97e0.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  PID:304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads