Analysis
-
max time kernel
62s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09-03-2024 20:30
General
-
Target
Growdice Predictor.exe
-
Size
884KB
-
MD5
e54e97f8bf65b46d5332517fc856c48c
-
SHA1
87f5c0e47e143d48422d1cb2e7f54112146478f3
-
SHA256
595251afc48ac7b968ddd6ddc47bbc02ab9cd72ef31e0e53f42f0a43b69c6d68
-
SHA512
1e4c69f11f07172bc40061201705c5055246bbd0df3cea9bd4fe661be58a74fb4858feb2216a56234a6be9d3cf382e614dc4ec60566c50a6b386de52cb789d00
-
SSDEEP
12288:BTEYAsROAsrt/uxduo1jB0Y96qzDRbezrMI8RolaP7U8ZMLkd/523W90Bx0URwx5:BwT7rC6qxezCuaDU8ZMc/k3WRz/7
Malware Config
Signatures
-
Detects Eternity stealer 2 IoCs
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 41 IoCs
-
Suspicious use of SendNotifyMessage 41 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Growdice Predictor.exe"C:\Users\Admin\AppData\Local\Temp\Growdice Predictor.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5b5ac46e446cead89892628f30a253a06
SHA1f4ad1044a7f77a1b02155c3a355a1bb4177076ca
SHA256def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
SHA512bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87
-
Filesize
884KB
MD5e54e97f8bf65b46d5332517fc856c48c
SHA187f5c0e47e143d48422d1cb2e7f54112146478f3
SHA256595251afc48ac7b968ddd6ddc47bbc02ab9cd72ef31e0e53f42f0a43b69c6d68
SHA5121e4c69f11f07172bc40061201705c5055246bbd0df3cea9bd4fe661be58a74fb4858feb2216a56234a6be9d3cf382e614dc4ec60566c50a6b386de52cb789d00
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
920KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB