f1b2fd2f89672413bba5dd5c96cf3d08b5a278752654f2486e94f85f8e895a7e

Analysis

max time kernel
145s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa052c2b8462eb327a55b820fbe5d1b6.exe
Size

6.5MB
MD5

aa052c2b8462eb327a55b820fbe5d1b6
SHA1

a57ae13239424bb1a5e201363b3cd832951a69ba
SHA256

f1b2fd2f89672413bba5dd5c96cf3d08b5a278752654f2486e94f85f8e895a7e
SHA512

0099b3074554a190c512cba38ada1a900d15d3fe0a8aa0b807a74b1d5da6f7efc2fb10c3771cb158a8271f6c007a5b6951594f975923427f40b942f6c6c9628c
SSDEEP

196608:2RPmCsXDjDyf6L2WliXYrHW13fZ4yxZW:2PmCEDVL2ciIrHWhf+W

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 13 IoCs

pid	Process
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe
1744	aa052c2b8462eb327a55b820fbe5d1b6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
30	pastebin.com
31	pastebin.com
32	discord.com
33	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	api.ipify.org
27	api.ipify.org

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1744	1932	aa052c2b8462eb327a55b820fbe5d1b6.exe	88
PID 1932 wrote to memory of 1744	1932	aa052c2b8462eb327a55b820fbe5d1b6.exe	88

C:\Users\Admin\AppData\Local\Temp\aa052c2b8462eb327a55b820fbe5d1b6.exe
"C:\Users\Admin\AppData\Local\Temp\aa052c2b8462eb327a55b820fbe5d1b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\aa052c2b8462eb327a55b820fbe5d1b6.exe
  "C:\Users\Admin\AppData\Local\Temp\aa052c2b8462eb327a55b820fbe5d1b6.exe"
  2⤵
  - Loads dropped DLL
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19322\VCRUNTIME140.dll

Filesize
94KB

MD5
18049f6811fc0f94547189a9e104f5d2

SHA1
dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6

SHA256
c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db

SHA512
38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\_bz2.pyd

Filesize
84KB

MD5
a991152fd5b8f2a0eb6c34582adf7111

SHA1
3589342abea22438e28aa0a0a86e2e96e08421a1

SHA256
7301fc2447e7e6d599472d2c52116fbe318a9ff9259b8a85981c419bfd20e3ef

SHA512
f039ac9473201d27882c0c11e5628a10bdbe5b4c9b78ead246fd53f09d25e74c984e9891fccbc27c63edc8846d5e70f765ca7b77847a45416675d2e7c04964fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\_ctypes.pyd

Filesize
124KB

MD5
7322f8245b5c8551d67c337c0dc247c9

SHA1
5f4cb918133daa86631211ae7fa65f26c23fcc98

SHA256
4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763

SHA512
52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\_hashlib.pyd

Filesize
64KB

MD5
88e2bf0a590791891fb5125ffcf5a318

SHA1
39f96abbabf3fdd46844ba5190d2043fb8388696

SHA256
e7aecb61a54dcc77b6d9cafe9a51fd1f8d78b2194cc3baf6304bbd1edfd0aee6

SHA512
7d91d2fa95bb0ffe92730679b9a82e13a3a6b9906b2c7f69bc9065f636a20be65e1d6e7a557bfd6e4b80edd0f00db92eb7fea06345c2c9b98176c65d18c4bdbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\_lzma.pyd

Filesize
159KB

MD5
cdd13b537dad6a910cb9cbb932770dc9

SHA1
b37706590d5b6f18c042119d616df6ff8ce3ad46

SHA256
638cd8c336f90629a6260e67827833143939497d542838846f4fc94b2475bb3e

SHA512
c375fb6914cda3ae7829d016d3084f3b5b9f78f200a62f076ec1646576f87694eec7fa6f1c99cbe30824f2fe6e2d61ecdeb50061383b12143cd2678004703199

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\_socket.pyd

Filesize
78KB

MD5
478abd499eefeba3e50cfc4ff50ec49d

SHA1
fe1aae16b411a9c349b0ac1e490236d4d55b95b2

SHA256
fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb

SHA512
475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\_ssl.pyd

Filesize
151KB

MD5
cf7886b3ac590d2ea1a6efe4ee47dc20

SHA1
8157a0c614360162588f698a2b0a4efe321ea427

SHA256
3d183c1b3a24d634387cce3835f58b8e1322bf96ab03f9fe9f02658fb17d1f8c

SHA512
b171f7d683621fdab5989bfed20c3f6479037035f334ea9a19feb1184f46976095a7666170a06f1258c6ddf2c1f8bdb4e31cbfd33d3b8fa4b330f097d1c09d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\base_library.zip

Filesize
763KB

MD5
c6b38adf85add9f9a7ea0b67eea508b4

SHA1
23a398ffdae6047d9777919f7b6200dd2a132887

SHA256
77479f65578cf9710981255a3ad5495d45f8367b2f43c2f0680fce0fed0e90fb

SHA512
d6abc793a7b6cc6138b50305a8c1cad10fa1628ca01a2284d82222db9bd1569959b05bdf4581d433ff227438131e43eec98bf265e746b17e76b1c9e9e21d447d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\libcrypto-1_1.dll

Filesize
1.6MB

MD5
2275330dbf045a3204bd3250aa2a4d2d

SHA1
2fe22be06f4e16c2b20768583582e80feb1f47ea

SHA256
c5997e296ee7b8312305a9dcdccc1df30e06ddcb1443e24e4b8e969b520a5307

SHA512
e0438e6a302dcad1d4650eb8ffa3325e91cd7e0859b586850a1fc666dde0e0f38ba796703a98e1f834d9eeb59913207a5767dfa1c074710452793124a56902ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\libcrypto-1_1.dll

Filesize
256KB

MD5
8eab67eaf7535a7135b29c38657a9cdc

SHA1
089b5c9b7c8b923d00d5ee594d2c3f682ff7c13b

SHA256
3682a253ea537d674ad87e44f522d2407d7223588a7400fee5c379c96a5abe3b

SHA512
119ae1899368eeab4c3c19f72a760d5d937f5eae3ac673965e53d7322d8471bfad781d542932ec15fb5273751325352cabc570bc544d18f0f2e3014a7c912a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\libssl-1_1.dll

Filesize
674KB

MD5
50bcfb04328fec1a22c31c0e39286470

SHA1
3a1b78faf34125c7b8d684419fa715c367db3daa

SHA256
fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9

SHA512
370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\python39.dll

Filesize
4.3MB

MD5
1d5e4c20a20740f38f061bdf48aaca4f

SHA1
de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

SHA256
f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

SHA512
9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\python39.dll

Filesize
4.3MB

MD5
0ba975cc477e5a0f60bcc1745d26e432

SHA1
33a5883117379475bc28a8cc7b998fb5f7c49cb4

SHA256
15012aa73c2741fc9e004e489a6349e48cb2e787c853f0b9f59b35bc04f1fd00

SHA512
ec4bb6868e5b0766320719c4f515280d23c04b69e374c032ab5194fa160f9cc937a789571f35e7f667d931aed5463ce65f1bff95de5e18661ebf16e87f531158

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\select.pyd

Filesize
28KB

MD5
fed3dae56f7c9ea35d2e896fede29581

SHA1
ae5b2ef114138c4d8a6479d6441967c170c5aa23

SHA256
d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931

SHA512
3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\unicodedata.pyd

Filesize
166KB

MD5
b3447ce52c84e3ed1587bafb5f8cc704

SHA1
1e012ea230dd1ce6aa69eccf90f7be9963345d73

SHA256
67406df62c143db640f65a8ac265c901099e79a8858740a99b5cfc2092203d2c

SHA512
e210bc4e5c7bf4fa0ce0929f156c138dc3877831331a09daa48df276e8fa1727ea17dc6570d34dea83274d250fac2ee90df77773f1067c7f4361800345f949a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19322\unicodedata.pyd

Filesize
1.1MB

MD5
cd12c15c6eef60d9ea058cd4092e5d1b

SHA1
57a7c0b0468f0be8e824561b45f86e0aa0db28dd

SHA256
e3ab6e5749a64e04ee8547f71748303ba159dd68dfc402cb69356f35e645badd

SHA512
514e76174f977cc73300bc40ff170007a444e743a39947d5e2f76e60b2a149c16d57b42b6a82a7fea8dd4e9addb3e876d8ab50ea1898ee896c1907667277cf00

Download Submit