Overview

overview

7

Static

static

3

1407f3f8a6...ed.dll

windows7-x64

7

1407f3f8a6...ed.dll

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/02/2024, 02:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1407f3f8a6e5ebd494135c28891536b10c81a2d7ecbd1a4e00d9c45ee340f9ed.dll

  • Size

    2.6MB

  • MD5

    1847df052bfb5992d01764cbd879d49e

  • SHA1

    e4976c67efe403a9077af59a875830c631ae0014

  • SHA256

    1407f3f8a6e5ebd494135c28891536b10c81a2d7ecbd1a4e00d9c45ee340f9ed

  • SHA512

    bf111fad039bd00529b300f4a2e817cb5caf09d6c3f26398de9e02cd8636a15d62441a469d3f12174c232abb77c9ac8c054a83c90cce58ac993e89be511e0ba3

  • SSDEEP

    49152:oVsKSdfgHG6Yhlk3YX8qYk1CPXgWMi5pXhEQTZ1lsc47ve8/yNzfgV5Y:q7X5GlThYk1KPMIe9/a

Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1407f3f8a6e5ebd494135c28891536b10c81a2d7ecbd1a4e00d9c45ee340f9ed.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1407f3f8a6e5ebd494135c28891536b10c81a2d7ecbd1a4e00d9c45ee340f9ed.dll,#1
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Users\Admin\AppData\Local\Temp\10F2.tmp
        C:\Users\Admin\AppData\Local\Temp\10F2.tmp
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:2668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\10F2.tmp
          Filesize

          145KB

          MD5

          c610e7ccd6859872c585b2a85d7dc992

          SHA1

          362b3d4b72e3add687c209c79b500b7c6a246d46

          SHA256

          14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

          SHA512

          8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

          Download Submit

        • memory/1684-1-0x0000000000490000-0x0000000000559000-memory.dmp

          Filesize

          804KB

          Download

        • memory/1684-0-0x0000000000490000-0x0000000000559000-memory.dmp

          Filesize

          804KB

          Download