ffd63fe2aeaa91f05bef47b3583290ccdba3f44912ab8b67044f3d58bf817ebf

Resubmissions

11-11-2023 01:44

231111-b5tg3sdf9y 6

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stormshot.PC.V1.0_4c9ef25b2f.exe
Size

2.8MB
MD5

6aae47cbaa4c56095a1eb0422c1d2ecb
SHA1

34e29d1801d270a2bd7ac02d4ea84c14c553d66f
SHA256

ffd63fe2aeaa91f05bef47b3583290ccdba3f44912ab8b67044f3d58bf817ebf
SHA512

d6b2406922d2618816db55110bf12a8579b69325e0c196d0d2508bafec68a0430acf48482160bf42cca4bd0995d864abfa2425e8e5af794c8d8d1c430fee4cff
SSDEEP

49152:c8ZQVqWu+fqu79LNTRBO1L2VQjJY80KruthaPVu+2zE0y5VCmdAlacRk3Y:vZARtBEqVQq80ThzTzEElask3Y

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4316	st_4c9ef25b2f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Stormshot.PC.V1.0_4c9ef25b2f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Stormshot.PC.V1.0_4c9ef25b2f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3372	Stormshot.PC.V1.0_4c9ef25b2f.exe
3372	Stormshot.PC.V1.0_4c9ef25b2f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4316	3372	Stormshot.PC.V1.0_4c9ef25b2f.exe	102
PID 3372 wrote to memory of 4316	3372	Stormshot.PC.V1.0_4c9ef25b2f.exe	102
PID 3372 wrote to memory of 4316	3372	Stormshot.PC.V1.0_4c9ef25b2f.exe	102

C:\Users\Admin\AppData\Local\Temp\Stormshot.PC.V1.0_4c9ef25b2f.exe
"C:\Users\Admin\AppData\Local\Temp\Stormshot.PC.V1.0_4c9ef25b2f.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe
  C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe
  2⤵
  - Executes dropped EXE
  PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\st_4c9ef25b2f.exe

Filesize
52.4MB

MD5
2dd6593bf8934eebaa3effb889ec03b0

SHA1
fc96e4f015156047280d7f99570de6ae81488dda

SHA256
d53bea3bfed0739885810c87ad5be9124b93bb90e9b88a1a5b883b48bf7aaaf3

SHA512
ac5247777b1743c199167f49166cb52b7a20e0dd7d06abfaae10e02654bbd4b773939ac0c628f86c71aefcbf75501cdc89ed395a491d93d0747e9a8be60fc6c7

Download Submit