Overview

overview

8

Static

static

3

b8f1aa4333...93.exe

windows7-x64

8

b8f1aa4333...93.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 04:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8f1aa433312cace60da05c40bfb6f637c8d4acbfc232c94c1efc9bc9b0a4f93.exe

  • Size

    33KB

  • MD5

    e6945b2c5fd3ab2124cbc153915869d7

  • SHA1

    fa8744f94b77bbd7b0e8e9e6309935071d69a767

  • SHA256

    b8f1aa433312cace60da05c40bfb6f637c8d4acbfc232c94c1efc9bc9b0a4f93

  • SHA512

    c5f9f9ce1eb4cf739a529ee89772472ca7da7ceeafa744cc61ff08ece0d4468d2d7f4c45fa4331ddf5ed1db92124850ef64eda984698d3fa0f6cc145793e88b6

  • SSDEEP

    768:JQ7ElOIEvzMXqtwp/lDTJg/MFksCRsd2u9C9MFWoVaZel:J6aYzMXqtGN/CstC9qVF

Score
8/10
spywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3332
      • C:\Users\Admin\AppData\Local\Temp\b8f1aa433312cace60da05c40bfb6f637c8d4acbfc232c94c1efc9bc9b0a4f93.exe
        "C:\Users\Admin\AppData\Local\Temp\b8f1aa433312cace60da05c40bfb6f637c8d4acbfc232c94c1efc9bc9b0a4f93.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops startup file
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:560
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3984
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              4⤵
                PID:4224
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:1192

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
            Filesize

            258KB

            MD5

            681678fb47205fe78fadb5a483a64ef6

            SHA1

            0bdc000c049de2b509f9d5aaa8126b62fe9413d4

            SHA256

            77612f5f94616944f564bcac0ee2ea86e44cd4adc827d8cbd9b03859e62faefc

            SHA512

            d51dbe674ec6f6424040b3ddf8cda91f45ca0964a7a4d48b8acab958d38f16da4a19a34df89fea39da9f39872fe65026b77ed6cdfcaf8902c4be729801742014

            Download Submit

          • C:\Program Files\dotnet\dotnet.exe
            Filesize

            172KB

            MD5

            b82d2e2ee0f6ae1fbce695c6e66c12b5

            SHA1

            2595ac29f22f4b43c04adc8f8572aa4de203a756

            SHA256

            0e85f8f45135ab9b9e5dc5675fa7900212a4c4061c8ebdb0ff5ae7179a004af2

            SHA512

            43da5b9a29b81a64a4dc95bee25500eb11da1825167f87892965d5384fc94b69f8c63a212686995adbbffb909d9862bf870184b3a31831f51a63ad2c835f1e35

            Download Submit

          • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
            Filesize

            488KB

            MD5

            1243193154e95c7605081439fccb9330

            SHA1

            bd373eacc39420652e6293177f00354562da605e

            SHA256

            ae96b4c8aa0f4165d9f142bb831beba588e9ac892282019856704219e42675cb

            SHA512

            badde7e83036841fd1f1bec9787603261bb3acf7337f8feef0a3b876e4046182d14c04de77d944741d6f71ba6e50b507316393a8d8b117bee917c60594692bd8

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\_desktop.ini
            Filesize

            8B

            MD5

            eb3fe7085aac4986a5db69d6c382011f

            SHA1

            19c0d93bf576dc3bcf232628428d6218f91767a0

            SHA256

            41f6ad8112406e684ecf32a535c20fbac2db8d577e00b14197146b599a4b6ab2

            SHA512

            26ed6484407c76b27987c2ed0e5ec2522ea6053de299c486841195690c536d72d0569fb291a9b9a91ce74fa22f4c37c43b491f4d0ff00afb8771bd36a7dcf508

            Download Submit

          • memory/4440-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/4440-5-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/4440-195-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/4440-1630-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/4440-5020-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/4440-7535-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download

          • memory/4440-8765-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

            Download