8d0824c5f74fc47720a1598f5e4ada19ccd851e7548e3b7ab66ef8c0a074afc5

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0073de463a0641808c9e6c5a08e4f222.dll
Size

236KB
MD5

0073de463a0641808c9e6c5a08e4f222
SHA1

99f3956709c6f75f191e02876d311455258af878
SHA256

8d0824c5f74fc47720a1598f5e4ada19ccd851e7548e3b7ab66ef8c0a074afc5
SHA512

9a1a78ba4408da3c8b5221e80cedb455b762d3cfe62757563242e2c00b01a4709ae2211638e85692c42e8793a27e6396d888f5939e417e5b51858095f210808a
SSDEEP

6144:tLOHgsqDQsf+YdotO7HlX0FDnH7SXaRY7Hbohjyu1MjYnjOGyj:t/DYLtOJXYD7y7HUhe6ti

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2080-0-0x00000000002F0000-0x0000000000394000-memory.dmp	upx
behavioral1/memory/2080-2-0x00000000002F0000-0x0000000000394000-memory.dmp	upx
behavioral1/memory/2080-1-0x00000000002F0000-0x0000000000394000-memory.dmp	upx
behavioral1/memory/2080-3-0x00000000002F0000-0x0000000000394000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 2080 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2000	2080	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2512 wrote to memory of 2080	2512	rundll32.exe	rundll32.exe
PID 2080 wrote to memory of 2000	2080	rundll32.exe	WerFault.exe
PID 2080 wrote to memory of 2000	2080	rundll32.exe	WerFault.exe
PID 2080 wrote to memory of 2000	2080	rundll32.exe	WerFault.exe
PID 2080 wrote to memory of 2000	2080	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0073de463a0641808c9e6c5a08e4f222.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0073de463a0641808c9e6c5a08e4f222.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 352
3⤵
- Program crash
PID:2000

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x00000000002F0000-0x0000000000394000-memory.dmp

Filesize
656KB

Download
memory/2080-2-0x00000000002F0000-0x0000000000394000-memory.dmp

Filesize
656KB

Download
memory/2080-1-0x00000000002F0000-0x0000000000394000-memory.dmp

Filesize
656KB

Download
memory/2080-3-0x00000000002F0000-0x0000000000394000-memory.dmp

Filesize
656KB

Download