Overview
overview
7Static
static
1MC-Session...in.zip
windows7-x64
1MC-Session...in.zip
windows10-2004-x64
1MC-Session...ew.png
windows7-x64
3MC-Session...ew.png
windows10-2004-x64
3MC-Session...ignore
windows7-x64
3MC-Session...ignore
windows10-2004-x64
3MC-Session...ICENSE
windows7-x64
1MC-Session...ICENSE
windows10-2004-x64
1MC-Session...DME.md
windows7-x64
3MC-Session...DME.md
windows10-2004-x64
3MC-Session...gradle
windows7-x64
3MC-Session...gradle
windows10-2004-x64
3MC-Session...er.jar
windows7-x64
1MC-Session...er.jar
windows10-2004-x64
7MC-Session...erties
windows7-x64
3MC-Session...erties
windows10-2004-x64
3MC-Session...radlew
ubuntu-18.04-amd64
1MC-Session...radlew
debian-9-armhf
1MC-Session...radlew
debian-9-mips
1MC-Session...radlew
debian-9-mipsel
1MC-Session...ew.bat
windows7-x64
1MC-Session...ew.bat
windows10-2004-x64
7MC-Session...gradle
windows7-x64
3MC-Session...gradle
windows10-2004-x64
3MC-Session...k.java
windows7-x64
3MC-Session...k.java
windows10-2004-x64
3MC-Session...n.java
windows7-x64
3MC-Session...n.java
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 08:06
Static task
static1
Behavioral task
behavioral1
Sample
MC-Session-Stealer-main.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
MC-Session-Stealer-main.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
MC-Session-Stealer-main/.github/preview.png
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
MC-Session-Stealer-main/.github/preview.png
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
MC-Session-Stealer-main/.gitignore
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
MC-Session-Stealer-main/.gitignore
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MC-Session-Stealer-main/LICENSE
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MC-Session-Stealer-main/LICENSE
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MC-Session-Stealer-main/README.md
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MC-Session-Stealer-main/README.md
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
MC-Session-Stealer-main/build.gradle
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
MC-Session-Stealer-main/build.gradle
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MC-Session-Stealer-main/gradle/wrapper/gradle-wrapper.jar
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
MC-Session-Stealer-main/gradle/wrapper/gradle-wrapper.jar
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
MC-Session-Stealer-main/gradle/wrapper/gradle-wrapper.properties
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
MC-Session-Stealer-main/gradle/wrapper/gradle-wrapper.properties
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MC-Session-Stealer-main/gradlew
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral18
Sample
MC-Session-Stealer-main/gradlew
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral19
Sample
MC-Session-Stealer-main/gradlew
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral20
Sample
MC-Session-Stealer-main/gradlew
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral21
Sample
MC-Session-Stealer-main/gradlew.bat
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
MC-Session-Stealer-main/gradlew.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
MC-Session-Stealer-main/settings.gradle
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
MC-Session-Stealer-main/settings.gradle
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
MC-Session-Stealer-main/src/main/java/com/github/shurpe/DiscordWebhook.java
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
MC-Session-Stealer-main/src/main/java/com/github/shurpe/DiscordWebhook.java
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
MC-Session-Stealer-main/src/main/java/com/github/shurpe/Main.java
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
MC-Session-Stealer-main/src/main/java/com/github/shurpe/Main.java
Resource
win10v2004-20240226-en
General
-
Target
MC-Session-Stealer-main/gradle/wrapper/gradle-wrapper.properties
-
Size
201B
-
MD5
b542f6de950d2b8c3243e177a10e5ef2
-
SHA1
d57f4eee8a60072b94db6f7aa45895fd0541e6c4
-
SHA256
d49834081516cc77c342a412b52f2360cf3b5ec9fab275dff44386d1e5bcb3da
-
SHA512
f0e5c529229bdf751e44ffbf3a186f5f0695a7e60e4b56fe92cc2b69905a1205c1f4804067fa9b399eb186d6fcb3da068bbc2bef3d2ff1a5943b19ba35a8db75
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.properties rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.properties\ = "properties_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\properties_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2404 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2404 AcroRd32.exe 2404 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2624 2868 cmd.exe 29 PID 2868 wrote to memory of 2624 2868 cmd.exe 29 PID 2868 wrote to memory of 2624 2868 cmd.exe 29 PID 2624 wrote to memory of 2404 2624 rundll32.exe 30 PID 2624 wrote to memory of 2404 2624 rundll32.exe 30 PID 2624 wrote to memory of 2404 2624 rundll32.exe 30 PID 2624 wrote to memory of 2404 2624 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\gradle\wrapper\gradle-wrapper.properties1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\gradle\wrapper\gradle-wrapper.properties2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MC-Session-Stealer-main\gradle\wrapper\gradle-wrapper.properties"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f285a93e2d7edc891464ffa68807e917
SHA1be1694283732a26dc27d217e6cfa2945c6994112
SHA2569aa94b5ae900d0f4d48cef8e599e4e417750222f82d7bd646207302a7d33e660
SHA512bf81295bf74983fc3e4dbeed03d048183df626c578b2d9b8f88f7233c46b9f33e3ef3edde832b7f1b97c183686205c6bfe686f77ac2c7aa12d16ac692b32b762