Overview

overview

10

Static

static

10

1bac03ccd6...6c.exe

windows7-x64

9

1bac03ccd6...6c.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 18:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe

  • Size

    1.9MB

  • MD5

    df3dfad79902f4241eadf30f6a881658

  • SHA1

    90011105dc428ba22ce0f1425744d48d7ec3c4e3

  • SHA256

    1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c

  • SHA512

    99774b1a06178114d1f1265d09d2708e133b16ead645d99a2be6bcd05f8f84dc041df25db0db9694634d5c53613fca3b603bef163b2b6ffb9fd50613f5880a93

  • SSDEEP

    49152:z4dPpim7xgptPbbKnEQQJb3fDISdSm6782ByLQQuB5M:kJ/7SLqncF3sNo2MLQlM

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 16 IoCs
  • UPX dump on OEP (original entry point) 18 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe
    "C:\Users\Admin\AppData\Local\Temp\1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe
      "C:\Users\Admin\AppData\Local\Temp\1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe
        "C:\Users\Admin\AppData\Local\Temp\1bac03ccd6678efc6c30b19065758479106e8c24dac4d45f3fb3c0a57c26c26c.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\asian beast public legs mistress .avi.exe
    Filesize

    1.8MB

    MD5

    8a910253347985b5869a6e831447bc4f

    SHA1

    66c62f6e7e81061c1f58550112d7c9d686cbb8e9

    SHA256

    a467330daacd5573bd090020b4d904be9c6216b4135a18da1ed8a1767aad0d1e

    SHA512

    cbbc85706f7d1da40cffba9d055de61eb6ac164879eed6d28a0290009398328c0b889f7a7cdfad8923584316aea437514c4469ed7b444744076efdbf23d136a2

    Download Submit

  • memory/1320-185-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-205-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-209-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-183-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-187-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-192-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-202-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-0-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-233-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-212-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-215-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-218-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-221-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-224-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-227-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1644-230-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3500-184-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download