1b4202988b0f690f67d8dc1bed190b15d6c5450bc50a61b7f583349d5c638fd8

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f24f813cbdc162ef39b6c6b77e8cebe.exe
Size

400KB
MD5

0f24f813cbdc162ef39b6c6b77e8cebe
SHA1

75b801575f255faee42bf588c7480cd692d159e5
SHA256

1b4202988b0f690f67d8dc1bed190b15d6c5450bc50a61b7f583349d5c638fd8
SHA512

c5ff2baba6cbae015a76c7fd7afd4267d943699ac23f83501ec924b3457ef1462132bbb8c72ccdb709f610688f94d17911011bbeb3c766bd3071a1226aeb1882
SSDEEP

12288:i7gS5hvyqz7kUw09oaeWnUXIDsSk9EePAC:i7gS5pycw09oae/XIDVb8AC

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{Binda}.exe	0f24f813cbdc162ef39b6c6b77e8cebe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{Binda}.exe	0f24f813cbdc162ef39b6c6b77e8cebe.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3916 set thread context of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91
PID 3916 wrote to memory of 3936	3916	0f24f813cbdc162ef39b6c6b77e8cebe.exe	91

C:\Users\Admin\AppData\Local\Temp\0f24f813cbdc162ef39b6c6b77e8cebe.exe
"C:\Users\Admin\AppData\Local\Temp\0f24f813cbdc162ef39b6c6b77e8cebe.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3916-0-0x0000000075580000-0x0000000075B31000-memory.dmp

Filesize
5.7MB

Download
memory/3916-1-0x0000000000A90000-0x0000000000AA0000-memory.dmp

Filesize
64KB

Download
memory/3916-2-0x0000000075580000-0x0000000075B31000-memory.dmp

Filesize
5.7MB

Download
memory/3916-13-0x0000000075580000-0x0000000075B31000-memory.dmp

Filesize
5.7MB

Download
memory/3936-5-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3936-11-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3936-10-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/3936-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download