Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 15:56

General

  • Target

    7aae61b78f8438a3e94bc40decc22a86.exe

  • Size

    892KB

  • MD5

    7aae61b78f8438a3e94bc40decc22a86

  • SHA1

    c91960b21520d1fd1a241224646c25288d7a4a1d

  • SHA256

    642812b1beae1322f0f6ad1ca08e0971e495267ac759eed9e4574390b5dd84db

  • SHA512

    1511280c183e7d7d9c3f5e68687ffe46821913f6080df16a879ed11ac916542f0aef4176e1e7ac6f4f83f9899d4886289684a9d77c3842f60249ab3640d6c31a

  • SSDEEP

    12288:nWvNpLZWDfWRe9LOWzQRV2+gZ88PIsbUN1g38ojd9ZFSmmW26dgYI5NXK2qosjB1:kLZWDlv+glws82dFOk4K2qo+E1kKYUa9

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 50 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7aae61b78f8438a3e94bc40decc22a86.exe
    "C:\Users\Admin\AppData\Local\Temp\7aae61b78f8438a3e94bc40decc22a86.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4552
    • C:\Users\Admin\AppData\Local\Temp\nsk6DFD.tmp\oniminstall.exe
      C:\Users\Admin\AppData\Local\Temp\nsk6DFD.tmp\oniminstall.exe ~URL Parts Error~~~~URL Parts Error~URL Parts Error~~#~4373~5623~~URL Parts Error~~SendRequest Error~EA-B0-6C-7B-55-B6~#~~SendRequest Error~~~~
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1356
      2⤵
      • Program crash
      PID:488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4552 -ip 4552
    1⤵
      PID:3248

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsk6DFD.tmp\Math.dll

      Filesize

      66KB

      MD5

      b140459077c7c39be4bef249c2f84535

      SHA1

      c56498241c2ddafb01961596da16d08d1b11cd35

      SHA256

      0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67

      SHA512

      fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328

    • memory/4552-73-0x00000000034B0000-0x00000000034CA000-memory.dmp

      Filesize

      104KB