Analysis
-
max time kernel
140s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 18:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
335b01a38b8f5f557094dd9cfe1d748c.exe
Resource
win7-20231215-en
7 signatures
150 seconds
General
-
Target
335b01a38b8f5f557094dd9cfe1d748c.exe
-
Size
1002KB
-
MD5
335b01a38b8f5f557094dd9cfe1d748c
-
SHA1
d43ff241b2dded8db09f959f2e29ba0226412e08
-
SHA256
3e6d98dfa9e0f27421888a5356e598bdfe72c317b3fad2be2a3d912be12e22e0
-
SHA512
8a17306b99af61e1909b9066db18aabc6de52d935b4a7d27ffa1f34b388619428cfdf8b23d8437da313d7df6b2c6503556c5f5e52c360d61512e446b6bbb4520
-
SSDEEP
24576:LzsjkZczo63M87odbJd5A8uvKXtvKouHPf4xVvCI:PsloTY4bSDvKXtvKDvgxVvr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3400 dlhelpdl.exe -
Loads dropped DLL 50 IoCs
pid Process 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 3400 dlhelpdl.exe 3400 dlhelpdl.exe 3400 dlhelpdl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3036 1760 WerFault.exe 20 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1760 wrote to memory of 3400 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 93 PID 1760 wrote to memory of 3400 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 93 PID 1760 wrote to memory of 3400 1760 335b01a38b8f5f557094dd9cfe1d748c.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\335b01a38b8f5f557094dd9cfe1d748c.exe"C:\Users\Admin\AppData\Local\Temp\335b01a38b8f5f557094dd9cfe1d748c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 11642⤵
- Program crash
PID:3036
-
-
C:\Users\Admin\AppData\Local\Temp\nsm7D5F.tmp\dlhelpdl.exeC:\Users\Admin\AppData\Local\Temp\nsm7D5F.tmp\dlhelpdl.exe ~URL Parts Error~~~~URL Parts Error~URL Parts Error~~#~4633~4639~~URL Parts Error~~SendRequest Error~5A-2E-32-B6-DB-C3~#~~SendRequest Error~~~~2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1760 -ip 17601⤵PID:1688