Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
74f114616b31a1a3f40369e16181c172.exe
Resource
win7-20231215-en
General
-
Target
74f114616b31a1a3f40369e16181c172.exe
-
Size
409KB
-
MD5
74f114616b31a1a3f40369e16181c172
-
SHA1
f9fffa2d49baa89312a97f136f958f5f4700d7b1
-
SHA256
76dbba22b3b61385d1da908e973192e978b211957173cf57a5e917a95f96c573
-
SHA512
b386322b35380d8cc64bdab0816bfca0e1eea167e4c9aef095cf0b62be5da35c112004d0bce50469c10ef3deb93d8052e0c3df0a378732e742722e0a52fa8ab7
-
SSDEEP
12288:8TanssOPBBD7lezfwVGA4ZdEdIW6m9jW1TYc4OH0j2neEoQT7rd:KanssOPBlgzoVJ4QQm9jWdkOk2n/rd
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
Processes:
74f114616b31a1a3f40369e16181c172.exedescription ioc process File created C:\Windows\SysWOW64\h4714log.txt 74f114616b31a1a3f40369e16181c172.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
74f114616b31a1a3f40369e16181c172.exenet.exedescription pid process target process PID 2308 wrote to memory of 1920 2308 74f114616b31a1a3f40369e16181c172.exe net.exe PID 2308 wrote to memory of 1920 2308 74f114616b31a1a3f40369e16181c172.exe net.exe PID 2308 wrote to memory of 1920 2308 74f114616b31a1a3f40369e16181c172.exe net.exe PID 2308 wrote to memory of 1920 2308 74f114616b31a1a3f40369e16181c172.exe net.exe PID 1920 wrote to memory of 2344 1920 net.exe net1.exe PID 1920 wrote to memory of 2344 1920 net.exe net1.exe PID 1920 wrote to memory of 2344 1920 net.exe net1.exe PID 1920 wrote to memory of 2344 1920 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f114616b31a1a3f40369e16181c172.exe"C:\Users\Admin\AppData\Local\Temp\74f114616b31a1a3f40369e16181c172.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess3⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2308-0-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-2-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-3-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-5-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-8-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-7-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-9-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-6-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-4-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-1-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-14-0x00000000754C0000-0x00000000754CC000-memory.dmpFilesize
48KB
-
memory/2308-13-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2308-12-0x0000000076D20000-0x0000000076D2A000-memory.dmpFilesize
40KB
-
memory/2308-15-0x0000000077240000-0x0000000077330000-memory.dmpFilesize
960KB
-
memory/2308-11-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/2308-10-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-16-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-17-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-18-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-19-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-20-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-21-0x0000000076D20000-0x0000000076D2A000-memory.dmpFilesize
40KB
-
memory/2308-22-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2308-24-0x0000000076C80000-0x0000000076C86000-memory.dmpFilesize
24KB
-
memory/2308-25-0x0000000075390000-0x0000000075399000-memory.dmpFilesize
36KB
-
memory/2308-26-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2308-27-0x000000007EF50000-0x000000007EFAC000-memory.dmpFilesize
368KB
-
memory/2308-28-0x0000000077240000-0x0000000077330000-memory.dmpFilesize
960KB
-
memory/2308-29-0x0000000076C80000-0x0000000076C86000-memory.dmpFilesize
24KB
-
memory/2308-30-0x0000000075390000-0x0000000075399000-memory.dmpFilesize
36KB