Overview

overview

10

Static

static

10

f14c14cf0e...41.exe

windows7-x64

9

f14c14cf0e...41.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 00:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe

  • Size

    524KB

  • MD5

    e93d2a6d2dc59fc706db9f97fcd3956c

  • SHA1

    3566c38153964d01449723f04079ce76a3ca616e

  • SHA256

    f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41

  • SHA512

    69befbe9d6cc8a61970c391682d510c1bc0c6445d162b3ce4e0b0f5cc8fb0848da47119970518170e0cac0e4941e71473543e407cfb7c1d89782aa1e451b5cf0

  • SSDEEP

    12288:VEQoSfqbMxnPI1KPd7xgmfN5LDyGHVZh13/WEAjcg+Ga0DSP+D:VyKPLp9DymVboYg+eg+D

Score
9/10
persistencespywarestealerupx

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 18 IoCs
  • UPX dump on OEP (original entry point) 20 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe
    "C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe
      "C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:392
      • C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe
        "C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3336
    • C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe
      "C:\Users\Admin\AppData\Local\Temp\f14c14cf0ea768d4563f727f182865e9ea9eac5462bd86a8a05a4427f31e9e41.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american porn gay big vagina bedroom .avi.exe
          Filesize

          2.0MB

          MD5

          50b4de0e5717c70ef125d5978825094a

          SHA1

          260bb45c970fba3fd299cd5c28d54f74533ed5cc

          SHA256

          daf2c60b51675946d87037e664f9d388c8f93c71b8e77c078f2bae85f38408f9

          SHA512

          296f69889fd60121fb1a774da353b20d1571f4116d2a3a5fc47e4d189ea00a33d9cd84fbb65d989a8d3fb5b2da0cd74fd8688cde867cbc8e2481328b7d878a2e

          Download Submit

        • C:\debug.txt
          Filesize

          146B

          MD5

          7fd65e2ba126a3876a6bb714d2db4346

          SHA1

          5551d4235fb8f8547bd6119bbf4d47b6696d938e

          SHA256

          55ad5b1f5c49d201dc3d31d26d9269967ff462e74de74a9246e8e1e8f82e15f5

          SHA512

          ac0ca13ae4a66accb9f261d718baa283498a04eb23f585385a79ea18bf82061bfc7c4d8187368ac64de38c2ccf3455d37c989cfa45283a4cb752a5a9ec529daa

          Download Submit

        • memory/392-181-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-222-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-210-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-242-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-238-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-185-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-191-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-234-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-201-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-205-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-180-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-214-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-218-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-0-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-226-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/1860-230-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/3336-182-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/3752-163-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/3752-183-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download