Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-03-2024 18:51
General
-
Target
2222-main/stpastio.exe
-
Size
1.0MB
-
MD5
76240af1d6ebffbf210af7d95b59b97e
-
SHA1
8f029dfb9a98bd1c34335010c97780ac3f602d61
-
SHA256
18f6c675acef58163ad7322fbbaf75ac8d92c50e3f4e2dd02f26bbc4a93f4262
-
SHA512
71f2a9bb9a3ba9b0123fa302c6a96f9ff5b58be7804d1a84c170c4b69173428ddbc6807e91e034b23f83db9b51dfb8c6c7ae439fb822b7887927e5c84c007687
-
SSDEEP
24576:jfQYNBhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoR12Q:Po54clgLH+tkWJ0N5
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2222-main\stpastio.exe"C:\Users\Admin\AppData\Local\Temp\2222-main\stpastio.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZZPyLZ078BFBFF000306D28AAE05B334\34078BFBFF000306D28AAE05B3ZZPyLZ\Browsers\Passwords\Passwords_Edge.txtFilesize
426B
MD542fa959509b3ed7c94c0cf3728b03f6d
SHA1661292176640beb0b38dc9e7a462518eb592d27d
SHA256870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00
SHA5127def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007
-
C:\Users\Admin\AppData\Local\Temp\ZZPyLZ078BFBFF000306D28AAE05B334\34078BFBFF000306D28AAE05B3ZZPyLZ\Grabber\AssertResize.jpgFilesize
195KB
MD5bc69a791c507c71438971c5e0cf19fc1
SHA1a855f608d6f9edeeb6b5f95a8b3c37dd38e12540
SHA2565e69c84bc884a6e5652637e8194092ace26fb8ee572360f8d62e60f6ba9638b6
SHA51282790b56be0bbbef76de7b3364df702ffb615f09374ddc28fad781ed048ad2e32ec2d1a059ad6cae99b61fccfde82aa13d72d6f374e43d7255629cf30a5b3972
-
C:\Users\Admin\AppData\Local\Temp\ZZPyLZ078BFBFF000306D28AAE05B334\34078BFBFF000306D28AAE05B3ZZPyLZ\Grabber\StartRequest.docFilesize
2.7MB
MD5350f0c4f39cf4747fd8ab733e0119b2e
SHA1450d8c536684cc9ab3cc647117be633a4ba14c10
SHA256f647c76ff472fa08c0f8e97d8fc49b78872613aa0adb725735d2783f9ef4ad26
SHA51273dbf6cd9160716a050f2dcfcda2c2d38aeec5b0142105f5541c797689c5fde0a9528b2558e26391cacdc04fbdf29c62a98261f1f5ef401fc119ced0f9dc2b89
-
memory/1228-0-0x00000125937F0000-0x00000125938FA000-memory.dmpFilesize
1.0MB
-
memory/1228-1-0x00007FFC7B2E0000-0x00007FFC7BDA1000-memory.dmpFilesize
10.8MB
-
memory/1228-2-0x0000012595630000-0x00000125956A6000-memory.dmpFilesize
472KB
-
memory/1228-3-0x0000012593CC0000-0x0000012593CD0000-memory.dmpFilesize
64KB
-
memory/1228-73-0x00007FFC7B2E0000-0x00007FFC7BDA1000-memory.dmpFilesize
10.8MB
-
memory/1228-74-0x0000012593CC0000-0x0000012593CD0000-memory.dmpFilesize
64KB
-
memory/1228-85-0x00007FFC7B2E0000-0x00007FFC7BDA1000-memory.dmpFilesize
10.8MB
