Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/03/2024, 03:02
General
-
Target
c24a07f5b692b56145555f84f2a883dd.exe
-
Size
864KB
-
MD5
c24a07f5b692b56145555f84f2a883dd
-
SHA1
2398679916138931a18b405c623784e00f5392a7
-
SHA256
09f47991335c1a8c80c9e58e7bdd16f5de70d1418392317c8bb3caa76edce5cb
-
SHA512
9e9d3b812d9dbe5a0c9101f2d01b63b56dda9ce2ecd323c8b48af884acf6bcf0efb9c4352ac2a86647ca18e5ff9e9508d156395e6bc4d15a32519d2259e4f7f9
-
SSDEEP
24576:aBDGQJOzYRq/lpF8c7wEeDbLnpMLxJJ+0C:23uYRc9QD/pixn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c24a07f5b692b56145555f84f2a883dd.exe"C:\Users\Admin\AppData\Local\Temp\c24a07f5b692b56145555f84f2a883dd.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Antivirus2008y\c24a07f5b692b56145555f84f2a883dd.exe"C:\Program Files (x86)\Antivirus2008y\c24a07f5b692b56145555f84f2a883dd.exe" /d:C:\Users\Admin\AppData\Local\Temp\c24a07f5b692b56145555f84f2a883dd.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x7c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
509KB
MD55d96e06c6206d4603c6d2faddf6a74bb
SHA1df7bd9c2c067bd20df87fcdb55350521031d544f
SHA256f33ae77f9de21b9255d27e3fedba3096ef9f60a631c298149cb43e969f22c6d1
SHA51284e620204438c8bbbe71708034c7cb7ff4da5e0717d192b2af5e8ee62bb9478e03668de38fa36fd3b54d608b386c80ee934f3efc440928693cb0e8e3f176ef17
-
Filesize
849KB
MD51cce61fa4775cf2bd1cd6ec21e66c81d
SHA1dd0ba7ae2c11996f21bd86a9a20e1ca6b4546c6e
SHA256b33750983c20d404a7344f015f526f5db644d095d467135e7ca70c088b748f46
SHA512942fa0fb58fc556c4f3a60bf2c3e09c4e87a9c7f6c6b9821b340195e7d29d0926c2d1426a7f0e8428029c721faa344c29683944beeac82a118d386f9237c4330
-
Filesize
864KB
MD5c24a07f5b692b56145555f84f2a883dd
SHA12398679916138931a18b405c623784e00f5392a7
SHA25609f47991335c1a8c80c9e58e7bdd16f5de70d1418392317c8bb3caa76edce5cb
SHA5129e9d3b812d9dbe5a0c9101f2d01b63b56dda9ce2ecd323c8b48af884acf6bcf0efb9c4352ac2a86647ca18e5ff9e9508d156395e6bc4d15a32519d2259e4f7f9
-
Filesize
632KB
MD56cf082fde03c158adf6113532e642c78
SHA14ac0ce78d850587601510c02406932025ab9a249
SHA256f6eb35a26a06d167be08e39c67f813d99950c7969cc5552ae1c9d49e299f39b2
SHA5121e9e39f872c4d8448a417865c0a06a6107c089f0b182a33a82e6437b7c1b5e3f4740f0cbb8474e17fa861820bc55ba6478d513a9a9516cf636f8be80826dad11
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB