Overview
overview
7Static
static
7Gruel.exe
windows7-x64
7Gruel.exe
windows10-2004-x64
7Happy99.exe
windows7-x64
5Happy99.exe
windows10-2004-x64
5MeltingScreen.exe
windows7-x64
1MeltingScreen.exe
windows10-2004-x64
1MsWorld.exe
windows7-x64
5MsWorld.exe
windows10-2004-x64
1MyDoom.exe
windows7-x64
7MyDoom.exe
windows10-2004-x64
7out.exe
windows7-x64
3out.exe
windows10-2004-x64
3NetSky.exe
windows7-x64
7NetSky.exe
windows10-2004-x64
7Parrot.exe
windows7-x64
6Parrot.exe
windows10-2004-x64
7Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 21:21
Behavioral task
behavioral1
Sample
Gruel.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Gruel.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Happy99.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Happy99.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
MeltingScreen.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
MeltingScreen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
MsWorld.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
MsWorld.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
MyDoom.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
MyDoom.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
out.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
out.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
NetSky.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
NetSky.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Parrot.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Parrot.exe
Resource
win10v2004-20240226-en
General
-
Target
NetSky.exe
-
Size
17KB
-
MD5
6f49434d7e4532520372a4721a7a9aec
-
SHA1
979e0112b24c1f490653e47e4a340b37f72d17cd
-
SHA256
15e48ef767e1b2d696d2f6beec08e12e6e6d8909c070347d2d10abe75c120495
-
SHA512
9c86461d65fa52dc0e2ab15f3b95b75fe572f7e46b20ada7fcae57b9fd5355bee6e31b47183d5465e97bc72a065fa96dc8330667fbd3e69b13ed561600e6672c
-
SSDEEP
384:7/q2Nfs60PUnfTSILFm4UY2t9L+a30Bpk+3NyqSTqOvSKz:XNNXnmwygkmNHSY
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 194.25.2.129 Destination IP 194.25.2.129 Destination IP 62.155.255.16 Destination IP 212.7.128.162 Destination IP 212.7.128.165 Destination IP 62.155.255.16 Destination IP 212.185.252.73 Destination IP 212.185.252.73 Destination IP 193.193.144.12 Destination IP 195.20.224.234 Destination IP 212.185.252.136 Destination IP 217.5.97.137 Destination IP 212.185.253.70 Destination IP 212.185.253.70 Destination IP 217.5.97.137 Destination IP 212.185.252.136 Destination IP 217.5.97.137 Destination IP 194.25.2.130 Destination IP 62.155.255.16 Destination IP 212.7.128.162 Destination IP 195.20.224.234 Destination IP 212.7.128.162 Destination IP 194.25.2.130 Destination IP 212.185.253.70 Destination IP 194.25.2.129 Destination IP 212.185.253.70 Destination IP 194.25.2.130 Destination IP 195.20.224.234 Destination IP 62.155.255.16 Destination IP 212.185.253.70 Destination IP 212.185.253.70 Destination IP 217.5.97.137 Destination IP 194.25.2.130 Destination IP 212.185.253.70 Destination IP 194.25.2.129 Destination IP 195.20.224.234 Destination IP 194.25.2.130 Destination IP 195.20.224.234 Destination IP 62.155.255.16 Destination IP 193.193.144.12 Destination IP 193.193.144.12 Destination IP 212.185.253.70 Destination IP 62.155.255.16 Destination IP 195.20.224.234 Destination IP 194.25.2.129 Destination IP 194.25.2.129 Destination IP 212.185.252.136 Destination IP 212.185.252.73 Destination IP 212.7.128.162 Destination IP 212.185.252.136 Destination IP 212.7.128.162 Destination IP 212.185.253.70 Destination IP 195.20.224.234 Destination IP 194.25.2.129 Destination IP 193.193.144.12 Destination IP 62.155.255.16 Destination IP 194.25.2.129 Destination IP 195.20.224.234 Destination IP 217.5.97.137 Destination IP 212.185.252.73 Destination IP 194.25.2.130 Destination IP 194.25.2.129 Destination IP 212.185.252.73 Destination IP 212.185.252.73 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NetSky.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ICQ Net = "C:\\Windows\\winlogon.exe -stealth" NetSky.exe -
Drops file in Windows directory 2 IoCs
Processes:
NetSky.exedescription ioc process File created C:\Windows\winlogon.exe NetSky.exe File opened for modification C:\Windows\winlogon.exe NetSky.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NetSky.exe"C:\Users\Admin\AppData\Local\Temp\NetSky.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4508-0-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-2-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-3-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-4-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-5-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-7-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-9-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-10-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-11-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-12-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-13-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-14-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4508-15-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB