4151ecae8aadd4911af52961c794d0a2dc0884acb63ef0cd6329335ee8026581

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687a1172ef625b7303fde8c83913c6f7.exe
Size

1.1MB
MD5

687a1172ef625b7303fde8c83913c6f7
SHA1

d61557360a6790851c9220caa1ea8f33214f8df4
SHA256

4151ecae8aadd4911af52961c794d0a2dc0884acb63ef0cd6329335ee8026581
SHA512

950af9612cc9b66c9200cc1c4da0b45ae9b0b5dfbf071e7c94fb30a373fcb226204a9205de9006f5352605764c7107da4abcd51190f1ccd9bf69bf8addfd04c3
SSDEEP

24576:hi7HQvWYd9GiC6bU4O4Z2ODAh8795CYL/gpWmqoPbISsRw0HKoZ:h+HQvz2iC6btOoNAhmhsjISeeC

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2036	tdhQCHROazJu6sp.exe
1740	CTS.exe

Loads dropped DLL 1 IoCs

pid	Process
3036	687a1172ef625b7303fde8c83913c6f7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1740-16-0x0000000000CF0000-0x0000000000D07000-memory.dmp	upx
behavioral1/files/0x000d00000001232d-14.dat	upx
behavioral1/memory/3036-11-0x0000000001230000-0x0000000001247000-memory.dmp	upx
behavioral1/memory/3036-0-0x0000000001230000-0x0000000001247000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	687a1172ef625b7303fde8c83913c6f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\GUMEA1.tmp\psmachine_64.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_es-419.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_gu.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_id.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_it.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_uk.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\psuser_64.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_es.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ro.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_el.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_en.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_fr.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ko.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_no.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_sl.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_vi.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdate.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_fil.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdate.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_de.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_et.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateHelper.msi	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateCore.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_fa.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_hi.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_lv.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ru.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\psmachine.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleCrashHandler64.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ml.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_mr.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ms.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_pt-BR.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_pt-PT.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_zh-TW.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateOnDemand.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateComRegisterShell64.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_iw.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_te.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_tr.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\npGoogleUpdate3.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ar.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_cs.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_fi.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_hr.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_sk.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_sw.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_zh-CN.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateSetup.exe	tdhQCHROazJu6sp.exe
File opened for modification	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateSetup.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_am.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_bg.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ca.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_en-GB.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_kn.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateWebPlugin.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_da.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_sv.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\GoogleUpdateBroker.exe	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\psuser.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_bn.dll	tdhQCHROazJu6sp.exe
File opened for modification	C:\Program Files (x86)\GUTEA2.tmp	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_ja.dll	tdhQCHROazJu6sp.exe
File created	C:\Program Files (x86)\GUMEA1.tmp\goopdateres_lt.dll	tdhQCHROazJu6sp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	687a1172ef625b7303fde8c83913c6f7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	687a1172ef625b7303fde8c83913c6f7.exe
Token: SeDebugPrivilege	1740	CTS.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 2036	3036	687a1172ef625b7303fde8c83913c6f7.exe	15
PID 3036 wrote to memory of 1740	3036	687a1172ef625b7303fde8c83913c6f7.exe	14
PID 3036 wrote to memory of 1740	3036	687a1172ef625b7303fde8c83913c6f7.exe	14
PID 3036 wrote to memory of 1740	3036	687a1172ef625b7303fde8c83913c6f7.exe	14
PID 3036 wrote to memory of 1740	3036	687a1172ef625b7303fde8c83913c6f7.exe	14

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Users\Admin\AppData\Local\Temp\tdhQCHROazJu6sp.exe
C:\Users\Admin\AppData\Local\Temp\tdhQCHROazJu6sp.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2036

C:\Users\Admin\AppData\Local\Temp\687a1172ef625b7303fde8c83913c6f7.exe
"C:\Users\Admin\AppData\Local\Temp\687a1172ef625b7303fde8c83913c6f7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tdhQCHROazJu6sp.exe

Filesize
75KB

MD5
88324754daaa68650487591c43cffa39

SHA1
a7b543a9c7c5e16ea81b995deb3101998fbaeea6

SHA256
730d0a0af966fa03bf71aca0ea835ee88009edee368c72c788c1ce112ea08322

SHA512
ba59e5a83c56f53b0af89e3d423509967e74f184549d4cfad5ab6c848da4c6777bd3c6fae2f678221f4d5f55caa49a969a4dda413ad3e3d522e87328be3c071b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tdhQCHROazJu6sp.exe

Filesize
13KB

MD5
b581135d7845b424fdb5e72b8ee96f28

SHA1
bc3b8125435cff642b35a68b42613c82612a7260

SHA256
683575532df9f17d1e5f9a1c136784b385c65769ff59e42215a127ca5dddedf2

SHA512
c7fc2de6914100d68b0cb481c27fd154090ee505fe944b2117de16b3c4b83697f9eedde09683ef29d67b82accd8e75d257ba66a832ffc9495a68b7563426d974

Download Submit
C:\Windows\CTS.exe

Filesize
29KB

MD5
70aa23c9229741a9b52e5ce388a883ac

SHA1
b42683e21e13de3f71db26635954d992ebe7119e

SHA256
9d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2

SHA512
be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5

Download Submit
\Users\Admin\AppData\Local\Temp\tdhQCHROazJu6sp.exe

Filesize
44KB

MD5
3d14f3d766ee9bff22f78fc8c0174411

SHA1
ca4cd40379ab11bbd688eb6fa05ba0091183e9af

SHA256
480bf03c38bdec88c48bc4dafc7f6b5bbc6978af26bc730ed18fa563864fd0b6

SHA512
7b1aeb809603af7fc18106762a22859e19df57583d03de6dc116d0662c4e2d83fc5b8238abdf71f69a2499a9b1891b6a3fe4543f975a73855169eb01e14b5868

Download Submit
memory/1740-16-0x0000000000CF0000-0x0000000000D07000-memory.dmp

Filesize
92KB

Download
memory/3036-12-0x0000000000CF0000-0x0000000000D07000-memory.dmp

Filesize
92KB

Download
memory/3036-15-0x0000000000CF0000-0x0000000000D07000-memory.dmp

Filesize
92KB

Download
memory/3036-11-0x0000000001230000-0x0000000001247000-memory.dmp

Filesize
92KB

Download
memory/3036-0-0x0000000001230000-0x0000000001247000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads