Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 15:17
Behavioral task
behavioral1
Sample
77b3333cabe2d5041127bccdfa6da28f.exe
Resource
win7-20231215-en
General
-
Target
77b3333cabe2d5041127bccdfa6da28f.exe
-
Size
11.6MB
-
MD5
77b3333cabe2d5041127bccdfa6da28f
-
SHA1
4f3e07889bb478e038f6f49dc509d4b3a75a50f9
-
SHA256
5e852a04af0d33a74c67ba22d6cdcf9371217dd5f71be4bf5adf61d1ac6492d5
-
SHA512
edc4402ee676397c44c23c0b57b396767b7d77f76bfda0ac6a719b21b0de9a3754b91b63baaad84de7824655181ca299c9f5d2bbedcf648afc44bcebbf086371
-
SSDEEP
196608:kHlAG6ZjgDzrF0Dn/RNrlHAjoG+IE9onJ5hrZE8hbJMFjfk5ZYiMF3INQu0lRfep:YlCuvB0LZxlHOFE9c5hlE8hyFA5ZYg/w
Malware Config
Signatures
-
Loads dropped DLL 45 IoCs
pid Process 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe 3008 77b3333cabe2d5041127bccdfa6da28f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3008 77b3333cabe2d5041127bccdfa6da28f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 3008 77b3333cabe2d5041127bccdfa6da28f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 3008 2672 77b3333cabe2d5041127bccdfa6da28f.exe 28 PID 2672 wrote to memory of 3008 2672 77b3333cabe2d5041127bccdfa6da28f.exe 28 PID 2672 wrote to memory of 3008 2672 77b3333cabe2d5041127bccdfa6da28f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe"C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe"C:\Users\Admin\AppData\Local\Temp\77b3333cabe2d5041127bccdfa6da28f.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD586109d2d1fccdb91968b7c1a63823731
SHA189dec67fbb4e467604f20c53c3ae3949471aef58
SHA25628efd36be6bbbc56a7219bed7cc132ce67baf629100cc03a08a804360f483db9
SHA5125d331f7f3ca413e77c33fa57e1f07ef43d064545ff1d143b9086211b42bbe165564c62b07d7a44615e75221613f3d3127ef5d7c7ec06315f0c397c0b059d2a37
-
Filesize
35KB
MD5e6c16a8f39eb63ee3c75c3498bccb35d
SHA1b28cfdab4f11b1ad1ffe52847b275fb3b356fe2a
SHA2566e1ae3d0bae24c9641d96719eb4e941a6ed17c1e1b90d8b7478d6f7cbf9c4d9f
SHA512daa2ff6e68fbe8062e46433fdd32382ce88dadcac400a6882961828583e73bbfbea1bca80690b13ba650e9e899b7ef41a86faafccf1719868cdbfdbc07623820
-
Filesize
12KB
MD5ff9b1e03922361e0a8be65e5e1421aac
SHA1d4d674fb4e0214903e341e98613328d51aff9054
SHA2562a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df
SHA5128cbbbbdc9a3d9e866dc88a655a75317f58cb4a49cb262975ff8c4ae5d47c344b86f69f6d2fc369dd7aa8ad7fcaa40d1937320e7e4f5923a03a39459b7bb247c0
-
Filesize
13KB
MD506358818f111a1c8e1b76d60a650c997
SHA15bbaf40aeb932766346631df25d887264aad7ac2
SHA256b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180
SHA512f954b4e56e3ace2c8e0961149cb5bd433f35530bc1c5e38ec5d2223ec3591df0998903b3928668c5d8c05f16eaa1c2adf41fc999690c42dafa794800fc4b193e
-
Filesize
14KB
MD56adf70fd22d5ca90269466e5fc2aca2b
SHA11d4cdf2b08154b33738c5244a8886284c71693b9
SHA2562f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4
SHA512efbd7133e5b5ef035f5a09d92b3b12d3ad367d6c35856a842536102d36a1ef53afe62ea3c3a5a4ae641bb28b6caaed18afa3519a637aa36f71f71979d4f61239
-
Filesize
10KB
MD564f6350fc1145db6337a9e3dfb83222f
SHA1fea799c3f2a655d5104a46b788d98ea272557ae5
SHA256821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e
SHA51258f90099630b98a632db38d7cc4a2f44c70bb012f55b3b5a69dffc3a76f6a2b30ab81d678b95e807c135b96633a0d8ed83428924a1c9d1dfdb7f2a3962a44d31
-
Filesize
17KB
MD59cf1780e69e1bf2df2487b4de72806e5
SHA10955d77afb6a8e786dcbbf4f0b5b221bc302c6c8
SHA25659cf35c376f312b1c6a5844f0740fcae4caaa5a3d3cd0e953959b5f4190a475d
SHA512b1c4e6841c739fccc86e95da53ae10c3efa18f3a747b8e92883e7224cbe4f44016102fb6f713aa4345ba37dbf7c07d5517dfe9d564e2d4d120d154fd7de717f9
-
Filesize
12KB
MD5670c2baf75e559b89435283298f75bef
SHA1be1e5a0711c6c0bb1e2aef4ed18a15ed5759b027
SHA256236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06
SHA51252554fe5308f7b758b66b48262aae1c180191358e15fdd85b7d5ef47a35677e079c3ef6a54e63d1520038bbfc79bad5b2534b1c2808217ffb53c55b7e8862fdb
-
Filesize
13KB
MD59098b9c8340047c6434825e18826cc18
SHA185dde191f6549aca0813d8a723d39b83c61002db
SHA256825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e
SHA512defc6852291b568793a48124184342272f4bc424f88de82a35335d5596dfacc93a52afc33c43337e4ceb800c5bd998493a7ba7f52c02a6027a4434d7e608fcae
-
Filesize
15KB
MD52f4c07b5fc3c6245b0e1269c0d1a5a97
SHA126ea9baabadf63e5a44f3b606139f249bd120b99
SHA256efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27
SHA51221e1ccbf238fd59c1ce80543a8f21858ae6e15ad1e8536a0144ec06791cd2488822ae87d84e331e9135142c76506e68fad7dbb4b26428ff3ac0d43f49e8fcc92
-
Filesize
17KB
MD5d2ef20fe88c483dc2588c03876058afd
SHA186a7a9e71df94fec73dd90a9a4cf5b7901ce622d
SHA2566cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33
SHA512d1ea9f01ea1a16b23b6219492b3d2a27b017ea8d5511549c82fe3a58da988b890e52d144630c55fd845b8d079c4b6d3fd2172020cecc5f6dd6a05b1495d18c71
-
Filesize
21KB
MD5363b8e9f9a119ee0a52d8e75083f3f5d
SHA1e0f4316f5afd2abc31047b50fdd7910d148a7611
SHA2561b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3
SHA5123862436b88dae084993772d6ebdd3c7a892a562045ce448bc6419c7c21c797c806ef6030157c8daf2e85a36b13ed0ce4475eb00e61ee0cbec4db2677e780f177
-
Filesize
12KB
MD56ffdcbb8b3860fab46a4666c97f17eaf
SHA187defb8a639e0af86b6943490eb5456d6d63183e
SHA2562ea2b17aaac9e572eef1239b01e8ad378829b765958fd1bf306f39983a76f944
SHA512769941e8aac1075415f27c272510eda7c6156a0f29f0a19523251367946340ef53315771e6985c91ff4314ba1fcb939b1d5cd197dcbdaaed272733c9875e9b5b
-
Filesize
13KB
MD535025bbdbea7932bbe4e79627250dc46
SHA14082c2aba70d98fcf6ec2b82ff4cc6692d7b56ac
SHA256800cc846930302519335afdd276f9cbbe5f940fe1e5035cb6baf4fb736d37434
SHA512a65e3c17e2ef456258eec06e81fcfa9af97a0d13b05eaca96935e371aa5e768eba9fa2e00f6cb5930d25d57380654cd2b8c8cb680a686c912e5f36a3046e0db9
-
Filesize
12KB
MD5dcd7e1c1f1e68405d66cef954cbaee38
SHA1bbe8c8bde0e1956f4d88d737d50b2215073cdcb1
SHA2560ec713f4f3e963f618873ff538c7dcc532e0faba5025c5a8e20ac089fdfcf1d4
SHA51210d2048ff68515862b95e658bb33e42ed0fd2ab70db66f2738487d21739172d4f24ffb8f239fdfc6f479ce582a85c3b8f8adfb5024dad5769713a4b3d22d3115
-
Filesize
10KB
MD5f35a4c3bb2fb8782c1c3f0d6b493ce77
SHA1688c8baa950cfd77fdded246976829cc7510fce9
SHA256a6feba74067fb03ee4ba53d1608ab8012eb6bd1f995ebc42c21d653d57b8320b
SHA5125cb5219dd33ac40bd901298f17945fad21b25b0358056d10c84440048cf845bbb7acd0f6501d4284508b7559eae04074b03d13f6a1e4069df011895dfd3ceac9
-
Filesize
10KB
MD5db1f79a96a1390028df325dd183ff9f1
SHA18373b6c44fdbece2c1ee5327a2bb5e5b0a719ed4
SHA2566429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da
SHA512dad71f250340e529883e3347e90e66a445641f019351e745940c6700145c6c923a9d5575efaf42436823bd8f1db44e9b00c99eb1cc41dc49425ea9db9847590e
-
Filesize
83KB
MD50c583614eb8ffb4c8c2d9e9880220f1d
SHA10b7fca03a971a0d3b0776698b51f62bca5043e4d
SHA2566cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
SHA51279bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
-
Filesize
177KB
MD547b879422f88a07aadf12201b370b851
SHA1d64fb4865bbb495006bf9fff33e46f8a005b10d4
SHA256f0a2c12614601f31262810c5830c00fd3e3658a0abba2d13b79caae27d6c55b4
SHA512f691f84817994dafa9a644984783fb1283a3ad7d7eef27cc2d427a63de9ed6901d99454ce4aca3683d123cf8af12e6179b81275c4bb7a7cf1c905540ee1fac6d
-
Filesize
131KB
MD5bbf539c8cbd17225a8d596e037695fb6
SHA1015b8903e8e83363c56c628d22cdd4c1466b0c4a
SHA256ad503c075de4a19058d9232e4151f97e60d4cea76fe8dd0d5ac8b4a73074a603
SHA5120533b0def1f6b516018de090ef11c4a04442a038f21c6d509d7f556cd764aaab16b58448b0afe7e32330dec594ac86f3ca091adcea531e664b33e228cbeb4ad7
-
Filesize
38KB
MD5697e768501131b184a4ca1a9181281fc
SHA1237faec3070e0c62cf0ad31cb66f5513821d790a
SHA256f7147a21de74e2e6f65d2d260cca97fc8f666b40d70eeb1a1d57a24b0ce12ae7
SHA512bd85221384d38895bf7b4ef9e2d6088943975627458ca7a537bfbd7a671637d449274c0394820a788493727e2a088baf715b9d814a5d351b001636e47558c1cd
-
Filesize
181KB
MD52645aa11d8c4ffb04a8c5e04a440ec46
SHA1a4a7250963d2bd9c6e76db3d0d11028395815856
SHA256519f9e23d88ae387ea7d38bbc941a770a4b3ecc8c464a8ed0d977004344e4de3
SHA512beaf0b144a3bbb1d5a8afd8601efe39f3a233eabe04e1aabd1e6fe3c68de640bf10e48dccc11576b8618b71307ac3019cd5a71d1e8014acd79955655c56bea9a
-
Filesize
74KB
MD535bbb04a44f81a1c95216a2dfdb82516
SHA1b7d8e69e2084e2d2a560b9ff2184f10de4576340
SHA256697e0a45ebe100dce1dc4e11d11cd9e2b60d74ef4c7df1cefbe0e334d3997f7a
SHA512742a1099c01f06a75c4f66c7399b3d85c064f1f24950f6f7101c1632048282dde6f9140bd3ddd2ee7230a31618ef483711f7b67a212deb3912d8319cfc6db6a5
-
Filesize
121KB
MD58d4f033d412ae7cb92f71a030f06f7e2
SHA1d8a0e1ad4e53f7ee6a59b12e9d096a704fff3809
SHA25674be594d02bca5ac096ae2d34786628a873e00f231e922d7842d2cd0ceedc33a
SHA5125b177a13f1f4ea552a348aefbe014d8394499c032b9bd39df8150cefec037d467655e00a2063aaefe36704969a9fd6a5d71776ec7ce966fce454e2c8a295cde0
-
Filesize
760KB
MD528912e44ef0184bde6985434aea2ea0f
SHA12983c2676458f1566e40d836eab93162e59a82dc
SHA256d8007cc9e158ceb6760a6d83016607dbfcbcaa5ab09068b85211c56f04862655
SHA512090718e1a802425ff188426281fcba1fe8c5d98f3beb3a1e504a534af31b7d9bd07f95fc85e3496ed771a92724fa025a780b4ee61a1d49648b9c765ca58186e8
-
Filesize
3.2MB
MD5cc4cbf715966cdcad95a1e6c95592b3d
SHA1d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA5123b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477
-
Filesize
673KB
MD5bc778f33480148efa5d62b2ec85aaa7d
SHA1b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA2569d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA51280c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
119KB
MD542d28dfc09aea43c507553b4d1fa240b
SHA13a15ad4954ad6cb40a9ac04cfbecf9862d7683f4
SHA2568f446455e25bff5267b1d7f6eaac8b440250e4316327cebeb59890926130fa2a
SHA5126a7b1762f9bce0547d30fbe3ba0b3320308b37f714259335b814ab216577777def7d05fb02622b702c34b2148e76bbeaf083f2cc5e6f8bd10a7204b1bfa9e1b4
-
Filesize
194KB
MD5e6bfbe1d1ced9db37390b6e85099c89e
SHA1ffe43b5c3efe6120059c85ca5fa951bb67076c3e
SHA25611c731212e7c93fdff721d4f62ba1f90ef407298d5b4c7e7cfc04552f9be67bc
SHA512fe5f305260629de597ed9a1e52bbff982cf2fff848e72f6ba4073899f4f5a05a88e8601531d7324ae676216037bd07c12918db2c55b7d2cb5457cf77928c7154
-
Filesize
3.6MB
MD5d8a6dff4f79e66c2b05c3528b902f6fc
SHA162989fccc089f70cc3994a3352dfb222e8a07023
SHA256b6166f6072f795c2bec5421cc3c762f0731d1aeb4b08c06f75e7d119e1256f72
SHA512f3e819f57114ba2f05db64deb353d0af79cda0943887ce1fa669ecb7204ec5bae263f9cd5cbebc7ab73b8418cb3c9a3badfc6a377ff9dbc4a48e588f4d461359
-
Filesize
26KB
MD5c05ff16ff578bc7d52f30528c2b17957
SHA13989ea93533431b6da8c3583513b05904b152de6
SHA2561ce5454774bf7b280b11b2b94298d41787e9bde4466d157040dd6a0fd78e982d
SHA51284b51276a8d463532713746d094144a69425921540657a8f15289fc9f6fe702ab38ffa4e163af48d2218435386e64eadd076612e0b6ea6b2d5c4a611dfd06479
-
Filesize
87KB
MD5ac11929e59fa2d7887703761d0aa01a1
SHA1355bfdb64a7cd612c5ac1f86aa018de0bcb68f63
SHA2564e8f2e01b8af90084af5454135a870b3e46002a81df56c60482cf153400a0e6d
SHA512184dc08b56fdfc0dcfe1d3ff4095eb003c74fbbdb897ae0553accdc8a1aae4a8e69d138226e5063ee58348fbc7011224c3e6b988a9967bab74056d48a673b9f0
-
Filesize
11KB
MD5a889578241518ba4b51f2167ea13f0cb
SHA1a649836b05c4beec51c8f6b6019e0cc773347bf5
SHA25606ac6134e98d9ea625e635d9512a259cf43b724e9a3fc8cd3776aaff46d051d9
SHA5123a470181d676ef7a3f8928497a0929ca1c30a93da9783d9e2d9a5ea313c9435a16aee5df5524119d2a177bd04ac6c4905eb1dd56764367263b549fdd9690621d