685c84b329c9b6b12fe75a6edb3f16b130e03f9600200718a8c47b90877af58a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5e203d62f8fccd1a02bdaf9bdb024d3.exe
Size

121KB
MD5

b5e203d62f8fccd1a02bdaf9bdb024d3
SHA1

f24cb2275a23dcc77dc86d9e931ddcdc5262ca79
SHA256

685c84b329c9b6b12fe75a6edb3f16b130e03f9600200718a8c47b90877af58a
SHA512

f66dd5110d5c065e94e70b704f39cd54c1d5ddc1a6e323ac739afe2de6263d98a89e731fc6823a0321cb1a09ac23b75596e39599c2999cd3f00509b9438b8b20
SSDEEP

1536:hGwbbydEbmTAkVzJ3imFRV3GwMNX7QAiGasPVJ:hraamxz4mXeX7Qe

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
460	web2net.exe
4488	web2net.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Login access = "C:\\Users\\Admin\\AppData\\Roaming\\web2net.exe"	b5e203d62f8fccd1a02bdaf9bdb024d3.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 460 set thread context of 4488	460	web2net.exe	98

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://zonedirector.com/1/"	web2net.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 4692 wrote to memory of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 4692 wrote to memory of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 4692 wrote to memory of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 4692 wrote to memory of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 4692 wrote to memory of 1216	4692	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	93
PID 1216 wrote to memory of 460	1216	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	94
PID 1216 wrote to memory of 460	1216	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	94
PID 1216 wrote to memory of 460	1216	b5e203d62f8fccd1a02bdaf9bdb024d3.exe	94
PID 460 wrote to memory of 4488	460	web2net.exe	98
PID 460 wrote to memory of 4488	460	web2net.exe	98
PID 460 wrote to memory of 4488	460	web2net.exe	98
PID 460 wrote to memory of 4488	460	web2net.exe	98
PID 460 wrote to memory of 4488	460	web2net.exe	98
PID 460 wrote to memory of 4488	460	web2net.exe	98

C:\Users\Admin\AppData\Local\Temp\b5e203d62f8fccd1a02bdaf9bdb024d3.exe
"C:\Users\Admin\AppData\Local\Temp\b5e203d62f8fccd1a02bdaf9bdb024d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\b5e203d62f8fccd1a02bdaf9bdb024d3.exe
  C:\Users\Admin\AppData\Local\Temp\b5e203d62f8fccd1a02bdaf9bdb024d3.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Users\Admin\AppData\Roaming\web2net.exe
    "C:\Users\Admin\AppData\Roaming\web2net.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\Users\Admin\AppData\Roaming\web2net.exe
      C:\Users\Admin\AppData\Roaming\web2net.exe
      4⤵
      Executes dropped EXE
      Modifies Internet Explorer start page
      PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\prefs.js

Filesize
6KB

MD5
2a4779382b78a06ba273f3efc052b559

SHA1
824a63bad1fdcda3c1f523c6b80e5f3c74051d84

SHA256
08148f316c6bf0e76070c22a4d1e2714fead434b4b6ac91b697232562a4f6046

SHA512
2ad14a0dc0f0213a717301c8b965ff5bb1adfe9f625944dbf036acd6899bce6c3f0b1217368aa41f2891be434be1fc13fd111dd81d473a94f37986b0d93737d0

Download Submit
C:\Users\Admin\AppData\Roaming\web2net.exe

Filesize
121KB

MD5
b5e203d62f8fccd1a02bdaf9bdb024d3

SHA1
f24cb2275a23dcc77dc86d9e931ddcdc5262ca79

SHA256
685c84b329c9b6b12fe75a6edb3f16b130e03f9600200718a8c47b90877af58a

SHA512
f66dd5110d5c065e94e70b704f39cd54c1d5ddc1a6e323ac739afe2de6263d98a89e731fc6823a0321cb1a09ac23b75596e39599c2999cd3f00509b9438b8b20

Download Submit
memory/1216-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1216-2-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1216-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1216-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads