Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
11/01/2024, 03:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
527832e28ac4e9f80f1db9e53f1c3d5a.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
- Target 527832e28ac4e9f80f1db9e53f1c3d5a.exe
- Size 736KB
- Sample240111-eh4lbaebck
- SHA256 27d4185fdccfd09c150d08b84dc5892b168674e2b10ae270e11dd0a3d58d677b
- MD5 527832e28ac4e9f80f1db9e53f1c3d5a
- SHA1 a49311efada253f3944995f436e1d24066689fe3
- SHA512 1c35bc077dc1f90a1df25ca5542b98d447a33fd8d67e7437c82a0e3cf73be9a0947770cc02b536e2cda4176964f97c40abaec9dd1b539aa680207266a83564d8
- SSDEEP 12288:6aWzgMg7v3qnCiMErQohh0F4CCJ8lny/QHUfwg4uJ:1aHMv6Corjqny/QHIj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1424 wrote to memory of 1572 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 98 PID 1424 wrote to memory of 1572 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 98 PID 1424 wrote to memory of 1572 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 98 PID 1424 wrote to memory of 4172 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 108 PID 1424 wrote to memory of 4172 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 108 PID 1424 wrote to memory of 4172 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 108 PID 1424 wrote to memory of 1840 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 107 PID 1424 wrote to memory of 1840 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 107 PID 1424 wrote to memory of 1840 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 107 PID 1424 wrote to memory of 4656 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 106 PID 1424 wrote to memory of 4656 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 106 PID 1424 wrote to memory of 4656 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 106 PID 1424 wrote to memory of 2276 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 104 PID 1424 wrote to memory of 2276 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 104 PID 1424 wrote to memory of 2276 1424 527832e28ac4e9f80f1db9e53f1c3d5a.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\527832e28ac4e9f80f1db9e53f1c3d5a.exe"C:\Users\Admin\AppData\Local\Temp\527832e28ac4e9f80f1db9e53f1c3d5a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\*.default\" & copy /y prefs.js "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"2⤵PID:1572
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Setup.dat" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles" & cd "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\*.default\" & cd adblockplus & del /f /q patterns-*.* & type ..\..\Setup.dat >> patterns.ini2⤵PID:2276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Preferences" "C:\Users\Admin\AppData\Local\Temp\..\Dane aplikacji\Google\Chrome\User Data\Default\Preferences"2⤵PID:4656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Preferences" "C:\Users\Admin\AppData\Local\Temp\..\Application Data\Google\Chrome\User Data\Default\Preferences"2⤵PID:1840
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /y "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Preferences" "C:\Users\Admin\AppData\Local\Temp\..\Google\Chrome\User Data\Default\Preferences"2⤵PID:4172
-