Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-03-2024 22:14

General

  • Target

    c8a9e48f3081d1a2b20fc01b6d9632198ca1126a6f324ffc70ed1c2c5a72cfd1.exe

  • Size

    2.0MB

  • MD5

    cd99315df33ef1c4472625eb0a0e7e26

  • SHA1

    5239c5b16ce0398d43b79b21a565291bfc098d14

  • SHA256

    c8a9e48f3081d1a2b20fc01b6d9632198ca1126a6f324ffc70ed1c2c5a72cfd1

  • SHA512

    72dcb41fd0c36c0bcf1e084c8fd410bf185e0ffbd27711b538baceef9ac39dee1828d47472d6ea33ff98b609bdfdc00325be825d2c8f2f8dc828a7d8a588c3bc

  • SSDEEP

    49152:LopKngIs0x3UGIj+qZ/0JgAWSjBUw0ICFMU3vm7D3Z6:MpKngPXjMey30JFMU3vQDp6

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8a9e48f3081d1a2b20fc01b6d9632198ca1126a6f324ffc70ed1c2c5a72cfd1.exe
    "C:\Users\Admin\AppData\Local\Temp\c8a9e48f3081d1a2b20fc01b6d9632198ca1126a6f324ffc70ed1c2c5a72cfd1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
      C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\CGIDGCGIEG.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Users\Admin\AppData\Local\Temp\CGIDGCGIEG.exe
          "C:\Users\Admin\AppData\Local\Temp\CGIDGCGIEG.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2876
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\CGIDGCGIEG.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:868
            • C:\Windows\SysWOW64\PING.EXE
              ping 2.2.2.2 -n 1 -w 3000
              6⤵
              • Runs ping.exe
              PID:1508
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BGIIEGIDHC.exe"
        3⤵
          PID:2300
      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3024
          • C:\Windows\SysWOW64\chcp.com
            chcp 1251
            4⤵
              PID:664
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
              4⤵
              • Creates scheduled task(s)
              PID:480

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\CGIDGCGIEG.exe

        Filesize

        101KB

        MD5

        42b838cf8bdf67400525e128d917f6e0

        SHA1

        a578f6faec738912dba8c41e7abe1502c46d0cae

        SHA256

        0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d

        SHA512

        f64b39d885375251ab7db72c57dc5b5095f0c6412169f1035d1f6a25b8415a2a01004d06bfa0267cf683ef7dea7a9f969ad43fde5a4376f1fcb65a57403433c0

      • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

        Filesize

        128B

        MD5

        11bb3db51f701d4e42d3287f71a6a43e

        SHA1

        63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

        SHA256

        6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

        SHA512

        907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

      • \ProgramData\mozglue.dll

        Filesize

        53KB

        MD5

        1077ae75e336dc71bb56f3e495638a7a

        SHA1

        d5b056969cfae46c97515aab3767c702c3494243

        SHA256

        5ea9e1050d5f804c938236f1b7ea535e94dc72e83cfb1482d9fc0996490cb2de

        SHA512

        89ef71920e38deb63da4efc1b2e7fb509ede5060af86c37ea0b8a43907ec69f72be8699edb8392e4312802ddd77e40b67653fd46196df4d278d35093a0ac5853

      • \ProgramData\nss3.dll

        Filesize

        205KB

        MD5

        a13abe8fd2e2931a109a839a55504af4

        SHA1

        1135d859e5a94ee9260712b78dd297beae146eb3

        SHA256

        3b68410cc2431c3b7d21c2d65e6980182678117fb73791a9eb232f8e7376e1c2

        SHA512

        802d0e72891791705a5bcc533bd2b4f5bca08d4b42085a817c8776fe768f206eaa9f7ddfa55666037a31849f372d84af7fa632333b2ae03b54be81066309db6e

      • \Users\Admin\AppData\Local\Temp\BroomSetup.exe

        Filesize

        1.7MB

        MD5

        eee5ddcffbed16222cac0a1b4e2e466e

        SHA1

        28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

        SHA256

        2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

        SHA512

        8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

      • \Users\Admin\AppData\Local\Temp\nso79C4.tmp\INetC.dll

        Filesize

        21KB

        MD5

        2b342079303895c50af8040a91f30f71

        SHA1

        b11335e1cb8356d9c337cb89fe81d669a69de17e

        SHA256

        2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

        SHA512

        550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

      • \Users\Admin\AppData\Local\Temp\syncUpd.exe

        Filesize

        64KB

        MD5

        80fbe2253d07a8ad08cf31c109f546f3

        SHA1

        06c514c6af9ef8825b621e73e5ac2d42c5e64251

        SHA256

        6348a99a4aa2b3f4bda5abc9f5abb9c2a5229ea492b6ee7f48ac221772cd07b4

        SHA512

        5a2c9fd8be3908384c38f915924a9f482bbc5548cb68eb46a756514e803976cf3b571b100088bdc3c94444f7660190f63bc1f8ce656014df597b1feedb47113d

      • \Users\Admin\AppData\Local\Temp\syncUpd.exe

        Filesize

        81KB

        MD5

        98849663180453dbf00b01d2e261757c

        SHA1

        9e199afe00212243f2854b305a422224c2ccddb8

        SHA256

        3883e654283a9723d6c7fdeb248f0b16e0f39344a96a922ca21c88a8dca648d4

        SHA512

        d38cef6c18172685a912756b1f2f3d710ebbb496f1783d030e8eb82656d223bf931bdc2ad4a3342ea1ab67b8a156817ac58d2c1cf0c23ef1b20c4d869a8cff22

      • memory/2208-89-0x0000000000220000-0x0000000000247000-memory.dmp

        Filesize

        156KB

      • memory/2208-129-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

        Filesize

        1024KB

      • memory/2208-35-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-34-0x0000000000220000-0x0000000000247000-memory.dmp

        Filesize

        156KB

      • memory/2208-44-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

      • memory/2208-73-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-116-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-109-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-82-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-128-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-123-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-88-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

        Filesize

        1024KB

      • memory/2208-90-0x0000000000400000-0x000000000063B000-memory.dmp

        Filesize

        2.2MB

      • memory/2208-33-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

        Filesize

        1024KB

      • memory/2300-170-0x00000000021E0000-0x00000000021E1000-memory.dmp

        Filesize

        4KB

      • memory/2644-30-0x0000000000400000-0x0000000000930000-memory.dmp

        Filesize

        5.2MB

      • memory/2644-31-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/2644-87-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/2644-74-0x0000000000400000-0x0000000000930000-memory.dmp

        Filesize

        5.2MB

      • memory/2644-176-0x0000000000400000-0x0000000000930000-memory.dmp

        Filesize

        5.2MB

      • memory/2868-29-0x0000000004D10000-0x0000000005240000-memory.dmp

        Filesize

        5.2MB

      • memory/2868-78-0x0000000004D10000-0x0000000005240000-memory.dmp

        Filesize

        5.2MB

      • memory/2868-27-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

      • memory/2876-164-0x0000000000EE0000-0x0000000000EFE000-memory.dmp

        Filesize

        120KB

      • memory/2876-169-0x0000000072300000-0x00000000729EE000-memory.dmp

        Filesize

        6.9MB

      • memory/2876-171-0x0000000004BE0000-0x0000000004C20000-memory.dmp

        Filesize

        256KB

      • memory/2876-178-0x0000000072300000-0x00000000729EE000-memory.dmp

        Filesize

        6.9MB

      • memory/2876-179-0x0000000004BE0000-0x0000000004C20000-memory.dmp

        Filesize

        256KB