7151d607b0888ced8ac61fdd59796b4ca0c9f2bb762776ec4e48bc851d35a720

Analysis

max time kernel
42s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

164593a343e4b60a40553af11ee353a0.exe
Size

293KB
MD5

164593a343e4b60a40553af11ee353a0
SHA1

ac07dd26052ee07c9b0d6e821b4d0870d503396b
SHA256

7151d607b0888ced8ac61fdd59796b4ca0c9f2bb762776ec4e48bc851d35a720
SHA512

868d4d8a53cfd59211b016c05e5f4cec4639f1d2d65c7dfe231ff88e9052bfdb35153c1fb6fa562399f8de98b8978c3476f41a2390ee02875d4728621eb34dbf
SSDEEP

6144:Lu2urzh9xu/XkauJzgtRDzSUxp3zfydsrNBAFxSrYPLS/zd:Lutrzh9xOXkFSteUxBTy+7rUYd

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	164593a343e4b60a40553af11ee353a0.exe

Executes dropped EXE 1 IoCs

pid	Process
3256	fitoprox30.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3256	4312	164593a343e4b60a40553af11ee353a0.exe	90
PID 4312 wrote to memory of 3256	4312	164593a343e4b60a40553af11ee353a0.exe	90
PID 4312 wrote to memory of 3256	4312	164593a343e4b60a40553af11ee353a0.exe	90

C:\Users\Admin\AppData\Local\Temp\164593a343e4b60a40553af11ee353a0.exe
"C:\Users\Admin\AppData\Local\Temp\164593a343e4b60a40553af11ee353a0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\fitoprox30.exe
  "C:\Users\Admin\AppData\Local\Temp\fitoprox30.exe"
  2⤵
  - Executes dropped EXE
  PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fitoprox30.exe

Filesize
490KB

MD5
80ce87dc2a8b79f885fa02fe803265d6

SHA1
080cb49c018d4e266dfedf193b6e8ed9b3e8aba7

SHA256
a0404c184b0ad1697e1b63cc3fa44bd29d28823dadd88d20a02a0da43be92df1

SHA512
9a4cd7497be54c6f833cc6e9051b2c2f3e9565f46f6f521e7c1cae4cc5c21a69810abfcf75b9bd54fe3b5b240af7a07e03f2af5d06363c55bf7c66b600a2e539

Download Submit
memory/3256-9-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/3256-10-0x0000000000130000-0x00000000001B1000-memory.dmp

Filesize
516KB

Download
memory/3256-11-0x0000000000130000-0x00000000001B1000-memory.dmp

Filesize
516KB

Download
memory/3256-12-0x0000000000130000-0x00000000001B1000-memory.dmp

Filesize
516KB

Download
memory/3256-13-0x0000000000130000-0x00000000001B1000-memory.dmp

Filesize
516KB

Download
memory/3256-14-0x0000000000130000-0x00000000001B1000-memory.dmp

Filesize
516KB

Download