Overview
overview
10Static
static
7cb1f3d6606...1b.exe
windows7-x64
10cb1f3d6606...1b.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$TEMP/BroomSetup.exe
windows7-x64
7$TEMP/BroomSetup.exe
windows10-2004-x64
7$TEMP/syncUpd.exe
windows7-x64
10$TEMP/syncUpd.exe
windows10-2004-x64
10General
-
Target
cb1f3d6606ab6a841506fa1a687977c4666d66822fd2fb0f7b7602a5557cb51b
-
Size
2.0MB
-
Sample
240312-2jmqhsef74
-
MD5
23f787b10ce46d6ae68ab2bbf43a355a
-
SHA1
2ef5ef0cd846509fafb6e2c43a230f473af260b3
-
SHA256
cb1f3d6606ab6a841506fa1a687977c4666d66822fd2fb0f7b7602a5557cb51b
-
SHA512
5f16a8ec72c53de509b895e5eb2fa8f2d1bcefa72a8794ed2eec23040b2647b4ed8905a2005c07200bc95586719d55810df2da4fc4efe65c2e6b06ed3ef3c49a
-
SSDEEP
49152:Lfs3IJVF1A7QIRXu0CYEewj53k/EWIQBA6nyZ:Ls3IrA71JuG+57Ei
Behavioral task
behavioral1
Sample
cb1f3d6606ab6a841506fa1a687977c4666d66822fd2fb0f7b7602a5557cb51b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb1f3d6606ab6a841506fa1a687977c4666d66822fd2fb0f7b7602a5557cb51b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/BroomSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/BroomSetup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$TEMP/syncUpd.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/syncUpd.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
stealc
http://185.172.128.145
-
url_path
/3cd2b41cbde8fc9c.php
Targets
-
-
Target
cb1f3d6606ab6a841506fa1a687977c4666d66822fd2fb0f7b7602a5557cb51b
-
Size
2.0MB
-
MD5
23f787b10ce46d6ae68ab2bbf43a355a
-
SHA1
2ef5ef0cd846509fafb6e2c43a230f473af260b3
-
SHA256
cb1f3d6606ab6a841506fa1a687977c4666d66822fd2fb0f7b7602a5557cb51b
-
SHA512
5f16a8ec72c53de509b895e5eb2fa8f2d1bcefa72a8794ed2eec23040b2647b4ed8905a2005c07200bc95586719d55810df2da4fc4efe65c2e6b06ed3ef3c49a
-
SSDEEP
49152:Lfs3IJVF1A7QIRXu0CYEewj53k/EWIQBA6nyZ:Ls3IrA71JuG+57Ei
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
$PLUGINSDIR/INetC.dll
-
Size
21KB
-
MD5
2b342079303895c50af8040a91f30f71
-
SHA1
b11335e1cb8356d9c337cb89fe81d669a69de17e
-
SHA256
2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
-
SHA512
550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
SSDEEP
384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
Score3/10 -
-
-
Target
$TEMP/BroomSetup.exe
-
Size
1.7MB
-
MD5
eee5ddcffbed16222cac0a1b4e2e466e
-
SHA1
28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
-
SHA256
2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
-
SHA512
8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
SSDEEP
49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
Score7/10 -
-
-
Target
$TEMP/syncUpd.exe
-
Size
200KB
-
MD5
c722591f624fb69970f246b8c81d830f
-
SHA1
85516decea5d6987bebe39cbadf36053beaf4bb0
-
SHA256
13cd1152a19fdac6581cac2bd822f34bd3026ea1783ff231e299b6d28c046a6a
-
SHA512
822584c5c8a0813af4d845e80919776c71a43464ab719d1c303ebaae6a8ed47763183566bedc9be2e8c44de8ee6fd62d1e12be471e5d5c73ae4b1dcdaa34a908
-
SSDEEP
3072:8PDOu5suCmavnBRsuP6GTdbB27zP6FtHPUxX1GOL3+:455zaPBRPPj27uPH8jzu
Score10/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-