Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
7aae61b78f8438a3e94bc40decc22a86.exe
Resource
win7-20231215-en
General
-
Target
7aae61b78f8438a3e94bc40decc22a86.exe
-
Size
892KB
-
MD5
7aae61b78f8438a3e94bc40decc22a86
-
SHA1
c91960b21520d1fd1a241224646c25288d7a4a1d
-
SHA256
642812b1beae1322f0f6ad1ca08e0971e495267ac759eed9e4574390b5dd84db
-
SHA512
1511280c183e7d7d9c3f5e68687ffe46821913f6080df16a879ed11ac916542f0aef4176e1e7ac6f4f83f9899d4886289684a9d77c3842f60249ab3640d6c31a
-
SSDEEP
12288:nWvNpLZWDfWRe9LOWzQRV2+gZ88PIsbUN1g38ojd9ZFSmmW26dgYI5NXK2qosjB1:kLZWDlv+glws82dFOk4K2qo+E1kKYUa9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3480 oniminstall.exe -
Loads dropped DLL 50 IoCs
pid Process 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 4552 7aae61b78f8438a3e94bc40decc22a86.exe 3480 oniminstall.exe 3480 oniminstall.exe 3480 oniminstall.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 488 4552 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4552 wrote to memory of 3480 4552 7aae61b78f8438a3e94bc40decc22a86.exe 63 PID 4552 wrote to memory of 3480 4552 7aae61b78f8438a3e94bc40decc22a86.exe 63 PID 4552 wrote to memory of 3480 4552 7aae61b78f8438a3e94bc40decc22a86.exe 63
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aae61b78f8438a3e94bc40decc22a86.exe"C:\Users\Admin\AppData\Local\Temp\7aae61b78f8438a3e94bc40decc22a86.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\nsk6DFD.tmp\oniminstall.exeC:\Users\Admin\AppData\Local\Temp\nsk6DFD.tmp\oniminstall.exe ~URL Parts Error~~~~URL Parts Error~URL Parts Error~~#~4373~5623~~URL Parts Error~~SendRequest Error~EA-B0-6C-7B-55-B6~#~~SendRequest Error~~~~2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 13562⤵
- Program crash
PID:488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4552 -ip 45521⤵PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5b140459077c7c39be4bef249c2f84535
SHA1c56498241c2ddafb01961596da16d08d1b11cd35
SHA2560598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
SHA512fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328