Overview
overview
7Static
static
3ba51622fc6...3e.exe
windows7-x64
7ba51622fc6...3e.exe
windows10-2004-x64
7$PLUGINSDI...er.exe
windows7-x64
7$PLUGINSDI...er.exe
windows10-2004-x64
7$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...se.dll
windows7-x64
3$PLUGINSDI...se.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...ib.dll
windows7-x64
3$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...BL.rtf
windows7-x64
4$PLUGINSDI...BL.rtf
windows10-2004-x64
1$PLUGINSDI...L2.rtf
windows7-x64
4$PLUGINSDI...L2.rtf
windows10-2004-x64
1Analysis
- max time kernel
172s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2024, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
ba51622fc65d03ace0e38e67956ab53e.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
ba51622fc65d03ace0e38e67956ab53e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/215AppsChecker.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/215AppsChecker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/AnimalShopping_license.rtf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/AnimalShopping_license.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/CustomLicense.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/CustomLicense.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/DefaultTab_license.rtf
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/DefaultTab_license.rtf
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/Iminent_license.rtf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/Iminent_license.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/frg_license.rtf
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/frg_license.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/gc_license.rtf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/gc_license.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/intlib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/intlib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/license_BL.rtf
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/license_BL.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/license_BL2.rtf
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/license_BL2.rtf
Resource
win10v2004-20231215-en
windows10-2004-x64
General
- Target ba51622fc65d03ace0e38e67956ab53e.exe
- Size 892KB
- Sample240308-c7vctsed4t
- SHA256 30320af96c03f12642620e050dc28005166e5311e4b3cca914b503934e36526f
- MD5 ba51622fc65d03ace0e38e67956ab53e
- SHA1 3fd11ef5f88170a21cf599ee0f719ccfee6d6b22
- SHA512 4e548b276810ec8477a665589668bd797efbc1fc69076a945adc9ff1c77e759b4b8ab5d8c4339937492c91b7dbc3050be1775f84c6630980dfb7b9b94ec9f190
- SSDEEP 24576:XXLZWDlv+glws82dFOk4K2qo+E1kKYUal:nLZWhv/istd0k/Po+EnOl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3460 oniminstall.exe - Loads dropped DLL 50 IoCs
pid Process 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 228 ba51622fc65d03ace0e38e67956ab53e.exe 3460 oniminstall.exe 3460 oniminstall.exe 3460 oniminstall.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 2944 228 WerFault.exe 85 - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023228-201.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 228 wrote to memory of 3460 228 ba51622fc65d03ace0e38e67956ab53e.exe 89 PID 228 wrote to memory of 3460 228 ba51622fc65d03ace0e38e67956ab53e.exe 89 PID 228 wrote to memory of 3460 228 ba51622fc65d03ace0e38e67956ab53e.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba51622fc65d03ace0e38e67956ab53e.exe"C:\Users\Admin\AppData\Local\Temp\ba51622fc65d03ace0e38e67956ab53e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\oniminstall.exeC:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\oniminstall.exe ~URL Parts Error~~~~URL Parts Error~URL Parts Error~~#~8084~5449~~URL Parts Error~~SendRequest Error~5E-23-96-FD-2B-C6~#~~SendRequest Error~~~~2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 1322⤵
- Program crash
PID:2944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 228 -ip 2281⤵PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\GetVersion.dll
- Size 6KB
- SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
- MD5 5264f7d6d89d1dc04955cfb391798446
- SHA1 211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc
- SHA512 80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7
- SSDEEP 96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\Math.dll
- Size 66KB
- SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
- MD5 b140459077c7c39be4bef249c2f84535
- SHA1 c56498241c2ddafb01961596da16d08d1b11cd35
- SHA512 fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
- SSDEEP 1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\intlib.dll
- Size 24KB
- SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
- MD5 1efbbf5a54eb145a1a422046fd8dfb2c
- SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
- SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
- SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\oniminstall.exe
- Size 115KB
- SHA256 6643a191b1bf0b01f8b4cc3b360750f1abbb0d03ea18eea26ea12a0e710b9871
- MD5 12b55ea61e82e5edcc8d52db29e5a094
- SHA1 6a1dc2b058bd63937b61a9572ec88c7f0e08d78a
- SHA512 c2e4074cb617eda5c3c8d448be1e2f9e5d17647bdb98cdf0c805b0caf5f16fe04615755b26087ccd2be8fa968f1271a76eed0f82fe53c44ae9dcc615519f3294
- SSDEEP 3072:fLk395hYXJpfTK1H5QFPG5Sf9/n5woP5PL0C6dF7C:fQq27QQEfBd6PC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvC7A6.tmp\registry.dll
- Size 16KB
- SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
- MD5 24a7a119e289f1b5b69f3d6cf258db7c
- SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
- SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
- SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
- MD5 SHA1 SHA512 SSDEEP