ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-01-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Size

924KB
MD5

ec9c3efe831aaa203058927df7de6138
SHA1

b77581e047551a70aaba0db7a57349136bd9e411
SHA256

63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222
SHA512

0d5aedcebaa660f345c549b9ae07b4d18fc01b563907b378c1cd905029bb0c6f6849e0f03c7c4a724c3448eb9c693138265a0b0129a298af3aada9bb0f447d6a
SSDEEP

12288:tZqu3sRwqpxGCMF3dera2ybCPWy5SqZWj+6GJZy82VS1ToBgdoByOHGae0r2ivr:B3yEoro2PEpUA

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Audio Driver HD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe"	63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2884	63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe

C:\Users\Admin\AppData\Local\Temp\63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
"C:\Users\Admin\AppData\Local\Temp\63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\9r0i9IS0.razy1337

Filesize
144B

MD5
beabbc1636860b1d5a29aca8f4794060

SHA1
0320036a6ef21f68e0c8a216d2e17721379187a0

SHA256
81b977e40e31c102171b4124b1619964330659dd6f51c9b908b876f35ed00d4c

SHA512
703fc731821ada4630a3b257f10567b4f2a6587810dcfb328e98240186dfca6a49dacfb0c7132105ba890b615852cc6b0da97547b222e76e17af37984886a680

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\x0rlKaJjOve.razy1337

Filesize
144B

MD5
674aa0911667eb87f061149c9aa6c821

SHA1
7f7669511e5b0d317c7254dc65fe243ae74ffc09

SHA256
3575d48737412b06f8bd7dbbe7b42fa194f09f8e6401a8291f11c94eefad0e08

SHA512
9780027b7acc5dd199afad6e222e84f474878ab76f073174db0788948450c8be33117d4dc23f53c2a4b17643880510ea48efb3a5eb5b5a8494d4a25480fd3adb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\2M5LtKCt.razy1337

Filesize
160B

MD5
79009e49998dc153dc77c460a2fa089f

SHA1
d6990fb12e5a894c7c5794dcc25d7d24ebfa2f96

SHA256
e94d32d87245fc804f09e917308197965024c064ef9692427133e4c911c4a11c

SHA512
c4883149c5b5ba955f65cae8aaea0b4e21ecac2eea3e6fb1da06c98b6b828f7e36a01c9e6c2b12ee1aa1dde1605c8832821a031de5cbf24c3fe2f505c7281a18

Download Submit
memory/2884-32-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2884-5-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2884-4-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2884-0-0x0000000000D50000-0x0000000000E3E000-memory.dmp

Filesize
952KB

Download
memory/2884-40-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2884-45-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2884-51-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2884-3-0x0000000004AE0000-0x0000000004B20000-memory.dmp

Filesize
256KB

Download
memory/2884-2-0x0000000000910000-0x000000000096C000-memory.dmp

Filesize
368KB

Download
memory/2884-1-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads