Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 09:38
Behavioral task
behavioral1
Sample
14b02dbba1ffd0a5662a3a5409b3028a.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
General
-
Target
14b02dbba1ffd0a5662a3a5409b3028a.exe
-
Size
867KB
-
MD5
14b02dbba1ffd0a5662a3a5409b3028a
-
SHA1
a220d5c6c57d821771a2e1734ee564a32d35c0f7
-
SHA256
32c01ca819cb302cf494240092ad3aef71737f98935d82b8dbd7a77f8eecb285
-
SHA512
5a8ef01c82be512cd6e63e29d022224b3da5879ace22d21701b2e8f5110e6cd503ff2b84544978f0f70917f8d26fd41e1de09a182c82e415e82a6f0c20e8174c
-
SSDEEP
12288:U98T9LqpZVjanWq5e+qOtvE22vKKswF40NEFPr7IU5VRVtoSWAg:AU0pPxqFzvevRpXNft
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1080 lsàss.exe -
Loads dropped DLL 2 IoCs
pid Process 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/760-0-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral1/files/0x0031000000015c7a-5.dat upx behavioral1/memory/760-7-0x0000000003570000-0x000000000364B000-memory.dmp upx behavioral1/memory/1080-14-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral1/memory/760-13-0x0000000000400000-0x00000000004DB000-memory.dmp upx behavioral1/memory/1080-35-0x0000000000400000-0x00000000004DB000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1080 lsàss.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe 1080 lsàss.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 760 wrote to memory of 1080 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 28 PID 760 wrote to memory of 1080 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 28 PID 760 wrote to memory of 1080 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 28 PID 760 wrote to memory of 1080 760 14b02dbba1ffd0a5662a3a5409b3028a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b02dbba1ffd0a5662a3a5409b3028a.exe"C:\Users\Admin\AppData\Local\Temp\14b02dbba1ffd0a5662a3a5409b3028a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Roaming\Options\lsàss.exe"C:\Users\Admin\AppData\Roaming\Options\lsàss.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26B
MD5c77a69ed87c6fe40c1377fec419efb41
SHA14d4acd63d8f566eeaa8429314c2cbf1f84eb2ef7
SHA256ffae6f640e8160bd599630503feced6783ba9f70d5bb0106df297cc995c82f79
SHA512ea621d4c854bc7a2044146766b7fe958fc333b806135b86dc58870241afded7eb40148dd669b974afff5be62958432e0f47169207801cd1abd1652291fd2231f
-
Filesize
867KB
MD514b02dbba1ffd0a5662a3a5409b3028a
SHA1a220d5c6c57d821771a2e1734ee564a32d35c0f7
SHA25632c01ca819cb302cf494240092ad3aef71737f98935d82b8dbd7a77f8eecb285
SHA5125a8ef01c82be512cd6e63e29d022224b3da5879ace22d21701b2e8f5110e6cd503ff2b84544978f0f70917f8d26fd41e1de09a182c82e415e82a6f0c20e8174c