Overview

overview

7

Static

static

3

9f4b0eb108...08.exe

windows7-x64

7

9f4b0eb108...08.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/02/2024, 03:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9f4b0eb108d105bd60ca73097022d108.exe
  • Size 249KB
  • Sample240216-dp5aragd87
  • SHA256 4fcc541f71f4ef015ff3393db384f3590cbc2cd8d742f1bad87ebbdaf516c71c
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealerupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 45 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f4b0eb108d105bd60ca73097022d108.exe
    "C:\Users\Admin\AppData\Local\Temp\9f4b0eb108d105bd60ca73097022d108.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\50ded009c38e2.exe
      .\50ded009c38e2.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:4868

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        uninstall.exe
        • Path C:\ProgramData\Zoomex\uninstall.exe
        • Size 48KB
        • SHA256 43c3e8d7aa00a299f084db17e384aa96de508565f82264ee88bd9c7647fa9fc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bootstrap.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\[email protected]\bootstrap.js
        • Size 2KB
        • SHA256 3ba440da32bedb5e2c8a18c6580c389bebe37a2f84ae82d3c10d8ceac8331437
        • MD5 SHA1 SHA512
        Submit Download

        chrome.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\[email protected]\chrome.manifest
        • Size 116B
        • SHA256 f017768fcd46c4b2ad00955511d09ea829d3d7ca1fef375b2a6a1b6c2cbafac5
        • MD5 SHA1 SHA512
        Submit Download

        bg.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\[email protected]\content\bg.js
        • Size 8KB
        • SHA256 e615719c51098ac806344ccfc9e0b88f441cd17d5570c4f953fc898bd5fec775
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zy.xul
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\[email protected]\content\zy.xul
        • Size 225B
        • SHA256 f45c458f00711565fe3920eef4cd7ce577fdbb1956c4e13c3fc03a7ac570a75e
        • MD5 SHA1 SHA512
        Submit Download

        install.rdf
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\[email protected]\install.rdf
        • Size 700B
        • SHA256 a8b4df0b02921ff1e11a835a8f3ba27fe08831ca5392b42f15862c6cd6481d97
        • MD5 SHA1 SHA512
        Submit Download

        50ded009c38e2.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\50ded009c38e2.exe
        • Size 70KB
        • SHA256 5e74f0e710c067ad82301c7c14ed6afb138f974f351042cfe0ecd275cea2612c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        50ded009c391b.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\50ded009c391b.dll
        • Size 115KB
        • SHA256 73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        50ded009c391b.tlb
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\50ded009c391b.tlb
        • Size 2KB
        • SHA256 a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568
        • MD5 SHA1 SHA512
        Submit Download

        gepfjojlgdipkmngibhfjbhjcipknfhb.crx
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\gepfjojlgdipkmngibhfjbhjcipknfhb.crx
        • Size 8KB
        • SHA256 28c035e4fd4100bb555a8ad84d5adc652f0bcf76cac88305b6863b6596e11dd7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        settings.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zS6A81.tmp\settings.ini
        • Size 6KB
        • SHA256 45cf778cf62559497685c10f507f4f471f3c3e2cd553a27ae8f4483b124918f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa6D61.tmp\UserInfo.dll
        • Size 4KB
        • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
        • MD5 SHA1 SHA512
        Submit Download

        nsJSON.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsa6D61.tmp\nsJSON.dll
        • Size 7KB
        • SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4868-53-0x00000000746F0000-0x00000000746FA000-memory.dmp
        Download