Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:38

General

  • Target

    a72d5fc2211db435af9ab375f832b3cd.exe

  • Size

    679KB

  • MD5

    a72d5fc2211db435af9ab375f832b3cd

  • SHA1

    7314bc8001f4aa904384a198e1df75660b3a5f63

  • SHA256

    8eef68e38ffd16167815c1e257779bd65af3accec82cd840905241c197ddcc2c

  • SHA512

    750ec66c04916748bdd99455d8507287b4da50949bc5677faadc2f72408a293a0f400a2bf97244693b7955e5afd7d915a5762733fe1432969943c41f3b393cb3

  • SSDEEP

    12288:o1P8JUFCBlF32PyN724Ck6TpxGbj8lleYIagaO:o1kJUFCBl52Pe724XSlzIagaO

Score
9/10

Malware Config

Signatures

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a72d5fc2211db435af9ab375f832b3cd.exe
    "C:\Users\Admin\AppData\Local\Temp\a72d5fc2211db435af9ab375f832b3cd.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe
      C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\Opera.txt
      2⤵
      • Executes dropped EXE
      PID:3392
    • C:\Users\Admin\AppData\Local\Temp\mspass.exe
      C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\MS.txt
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1584
    • C:\Users\Admin\AppData\Local\Temp\ProduKey.exe
      C:\Users\Admin\AppData\Local\Temp\ProduKey.exe /stext C:\Users\Admin\AppData\Local\Temp\ProduKey.txt
      2⤵
      • Executes dropped EXE
      PID:2332
    • C:\Users\Admin\AppData\Local\Temp\MC.exe
      C:\Users\Admin\AppData\Local\Temp\MC.exe
      2⤵
      • Executes dropped EXE
      PID:2240

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\FZ.txt

          Filesize

          2B

          MD5

          81051bcc2cf1bedf378224b0a93e2877

          SHA1

          ba8ab5a0280b953aa97435ff8946cbcbb2755a27

          SHA256

          7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

          SHA512

          1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

        • C:\Users\Admin\AppData\Local\Temp\MC.exe

          Filesize

          32KB

          MD5

          eba43e8a28297df4146bef07654f4580

          SHA1

          a5e96a0e8cd441f48dfcc3b97d45b0b466a864fa

          SHA256

          714eb102758c1c0feaf34a7e888026e7c073b893e931ac12ec6f607627b55af9

          SHA512

          2748f1f943767b5f2df5c9bc85f325a85f2d1c55090aa6e2d8e04901777200ba34ea75c4c6c49b473f964280b58f00e591f67a3b56f4e89f958e9f65966825bb

        • C:\Users\Admin\AppData\Local\Temp\Opera.txt

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\ProduKey.exe

          Filesize

          37KB

          MD5

          12507d0c4b2963ba229e02ff961ec400

          SHA1

          6a9b296e5b614457f106cfc8ed6fc24bd75ba9aa

          SHA256

          bbcb52b0538c81d9ced034e2c0435188bcd1d36f09bce76654f494e4d5dcdb0c

          SHA512

          1ad84dc8f90fd2342f4136d7594a0e10ea6ceefa0fd1b64a96a9200af260f76e3be22e1e3d6577c8b6b9a4ac655d0a8e2e2615f52114e1b11fd0773ec4e2bf10

        • C:\Users\Admin\AppData\Local\Temp\ProduKey.txt

          Filesize

          729B

          MD5

          29662ec08f5aa491b2733fa5f4dee30d

          SHA1

          bde21bcab3fc10cd6795a821e4f039fe4ff876e8

          SHA256

          365b0c56b65f24da09586d7cda5f7389666d8ce6585c2deb19c26868f0979d38

          SHA512

          a5216d00c9be46d2a3c8119c4dc17d458ecec36ef03e9de7001911ed423024c3b95e5ec665d5d4f6baadcf56d2afd792ae8a9fe133f31574f82973f391255329

        • C:\Users\Admin\AppData\Local\Temp\WebBrowserPassView.exe

          Filesize

          321KB

          MD5

          3b6bcf49057ea94968017b3d14cdf72d

          SHA1

          41ca649fdc27e352d2f7f8b4e14f84d21d20ab4b

          SHA256

          989f90eb63cf2c215d81a9838911f990e1bf4a97660c21a988d74f605abfc6e9

          SHA512

          cfe0daaba893458553655b4b30a51fcd25e2be8023c3328f4420dff44909cd66131d41cce39843a1883f56b49a423a821e79fc235b169ff1d2087f72f9a20206

        • C:\Users\Admin\AppData\Local\Temp\mspass.exe

          Filesize

          65KB

          MD5

          ffc52f2b4435fcddaca6e15489a88b75

          SHA1

          63ec31a04cf176852344d544ae855da0dac64980

          SHA256

          3f3c8484962b395f304a836ee5e8ee17beaafe982795c9747d8ee98cc6e4ca8f

          SHA512

          389694feccfe6ca352705b9481913fece6d1d47083f235ccdd60c05cfda82606be53845fde0dba8ec3f3748f820a828c9be0ce078c8b9cc853285b23f172841c

        • memory/1584-14-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1584-15-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2240-37-0x0000000140000000-0x0000000140017000-memory.dmp

          Filesize

          92KB

        • memory/2332-23-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/2332-26-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

        • memory/4304-40-0x00000000754C0000-0x0000000075A71000-memory.dmp

          Filesize

          5.7MB

        • memory/4304-42-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-30-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-0-0x00000000754C0000-0x0000000075A71000-memory.dmp

          Filesize

          5.7MB

        • memory/4304-2-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-1-0x00000000754C0000-0x0000000075A71000-memory.dmp

          Filesize

          5.7MB

        • memory/4304-28-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-39-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-41-0x00000000754C0000-0x0000000075A71000-memory.dmp

          Filesize

          5.7MB

        • memory/4304-29-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-43-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-44-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-45-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-46-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-47-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB

        • memory/4304-59-0x0000000001830000-0x0000000001840000-memory.dmp

          Filesize

          64KB