ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Size

924KB
MD5

ec9c3efe831aaa203058927df7de6138
SHA1

b77581e047551a70aaba0db7a57349136bd9e411
SHA256

63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222
SHA512

0d5aedcebaa660f345c549b9ae07b4d18fc01b563907b378c1cd905029bb0c6f6849e0f03c7c4a724c3448eb9c693138265a0b0129a298af3aada9bb0f447d6a
SSDEEP

12288:tZqu3sRwqpxGCMF3dera2ybCPWy5SqZWj+6GJZy82VS1ToBgdoByOHGae0r2ivr:B3yEoro2PEpUA

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Audio Driver HD = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe"	63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3220	63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe

C:\Users\Admin\AppData\Local\Temp\63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
"C:\Users\Admin\AppData\Local\Temp\63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: RenamesItself
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\3Sa4mkDqey9x.razy1337

Filesize
144B

MD5
ed31c4c10f47ab96feeb6c29edfe8945

SHA1
26a4bc6b03e2da43445d5c7128b5e1ba22336833

SHA256
4d3579c907887ffc8cafe171af5926fa612836ced0859021253a8345e044e36f

SHA512
79b10bd1fb77170797c81c7d95e7f731dec24d6a69aec5dc8d515a680c91ed308fcd7d401eed98f81783379a200a2a18896095f8dff69ee1e4126676fd4b7dc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\dmR6rYL1N.razy1337

Filesize
144B

MD5
e2e2ea411234c505fdc04c9613d0e071

SHA1
efa39cf0ac5ae00fd143cad07c7b54f96c9a4bf5

SHA256
3a671ab184ce9bf4f1290b0df354353353a2c6455592c5ada288a09d3a61a37f

SHA512
82a06aa91853053f06bd37bde04878ee7f0dabe49ce04b18b7bb3e1751c8adbce1c89201b6c70b4a5db0457292c8c2a14e2c35b5b2e1d04ea0e4d08de1dcfa2a

Download Submit
memory/3220-6-0x00000000051B0000-0x0000000005242000-memory.dmp

Filesize
584KB

Download
memory/3220-3-0x0000000009730000-0x00000000097CC000-memory.dmp

Filesize
624KB

Download
memory/3220-4-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/3220-5-0x0000000009D80000-0x000000000A324000-memory.dmp

Filesize
5.6MB

Download
memory/3220-1-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/3220-7-0x0000000005180000-0x000000000518A000-memory.dmp

Filesize
40KB

Download
memory/3220-8-0x00000000053E0000-0x0000000005436000-memory.dmp

Filesize
344KB

Download
memory/3220-9-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/3220-47-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/3220-52-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/3220-58-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/3220-2-0x0000000004F60000-0x0000000004FBC000-memory.dmp

Filesize
368KB

Download
memory/3220-0-0x0000000000550000-0x000000000063E000-memory.dmp

Filesize
952KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads