c647501400254ffc0db3a7e4a646b91577bb4908a775faae6dd8e9d8c5a4d281

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

660240e1f1c29761463d58b4d49a6528.exe
Size

97KB
MD5

660240e1f1c29761463d58b4d49a6528
SHA1

a086a215f8d7b12ba360cedaa7b7377c186d845b
SHA256

c647501400254ffc0db3a7e4a646b91577bb4908a775faae6dd8e9d8c5a4d281
SHA512

7fc971849f7a7dac3acbb03dcc2f374196ad86371513c185be79d4b811c8c65aaa01744d39257190d33c1a8090063f94ef5f3872facf713182841f5fb10b6113
SSDEEP

1536:WHbjGz1HRU1OWTP3YFz4T7lkFYNP7a1tRKKANDxURweWpRAhw8bueNV3INu6:W7jG/wJnzPG1LoDxUnWHew8bv4Nu6

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3028	Alfaseeker.exe

Loads dropped DLL 6 IoCs

pid	Process
2548	660240e1f1c29761463d58b4d49a6528.exe
2548	660240e1f1c29761463d58b4d49a6528.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe
2560	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x00000000007BB000-memory.dmp	upx
behavioral1/memory/2548-15-0x0000000000400000-0x00000000007BB000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
2560	3028	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3028	2548	660240e1f1c29761463d58b4d49a6528.exe	17
PID 2548 wrote to memory of 3028	2548	660240e1f1c29761463d58b4d49a6528.exe	17
PID 2548 wrote to memory of 3028	2548	660240e1f1c29761463d58b4d49a6528.exe	17
PID 2548 wrote to memory of 3028	2548	660240e1f1c29761463d58b4d49a6528.exe	17
PID 3028 wrote to memory of 2560	3028	Alfaseeker.exe	16
PID 3028 wrote to memory of 2560	3028	Alfaseeker.exe	16
PID 3028 wrote to memory of 2560	3028	Alfaseeker.exe	16
PID 3028 wrote to memory of 2560	3028	Alfaseeker.exe	16

C:\Users\Admin\AppData\Local\Temp\660240e1f1c29761463d58b4d49a6528.exe
"C:\Users\Admin\AppData\Local\Temp\660240e1f1c29761463d58b4d49a6528.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\Alfaseeker.exe
  C:\Users\Admin\AppData\Local\Temp\Alfaseeker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 388
1⤵
- Loads dropped DLL
- Program crash
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Alfaseeker.exe

Filesize
58KB

MD5
0cd5dd75f4ff9f29a264a09574159b7a

SHA1
73a8bcf834fdecebd7423ce2faf744f909128576

SHA256
5bc0856fc8bd90cfe981ea19355a1e29dc53775c42cd064f6d23f948190dbb31

SHA512
15bfcb8f2d31cb379b7891891ce71360bbecbd4b9a55f60f693f62339dff18aaeee5d56f4d57206478ab7416473932380c2798e8589f57ce9e3f83dabd5fe5f6

Download Submit
memory/2548-0-0x0000000000400000-0x00000000007BB000-memory.dmp

Filesize
3.7MB

Download
memory/2548-15-0x0000000000400000-0x00000000007BB000-memory.dmp

Filesize
3.7MB

Download
memory/3028-10-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3028-9-0x00000000001C0000-0x00000000001C5000-memory.dmp

Filesize
20KB

Download