Analysis
-
max time kernel
163s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 20:08
Behavioral task
behavioral1
Sample
511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe
-
Size
367KB
-
MD5
e3964993ceae9963cb6a2e2215bc7589
-
SHA1
e5ae93b2e3f0443c02180c09e56f564ea5b3efa3
-
SHA256
511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742
-
SHA512
6d622e2c623afcfecc0fa599f77a1b17a5520d110d3138f2ee59d4b5f0d71add3bdd51b53305043c3d976b35c2b0c23b165825ddf011e48d8838cbec9dd9ba8e
-
SSDEEP
6144:sPDLCL9Io5R4nM/40yFnV3swaX8Ag/PP+XJz2CX27BiWkyRAKdjn6pJp6srB4hB:sPKLXqtVcPkHPQIC4ivyRAqnKpPrBSB
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000700000002322d-5.dat UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2344-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000700000002322d-5.dat upx behavioral2/memory/2052-11-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4552-13-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3316-14-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2344-19-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2052-22-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4552-25-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3316-27-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\X: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\J: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\N: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\Q: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\R: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\A: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\K: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\S: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\Y: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\O: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\U: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\W: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\Z: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\B: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\E: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\H: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\L: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\T: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\G: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\I: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\M: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File opened (read-only) \??\P: 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\british porn action [bangbus] legs redhair .rar.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Microsoft Office\root\Templates\danish bukkake several models girly .mpg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Microsoft Office\Updates\Download\spanish lesbian lesbian (Sandy,Christine).mpg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Google\Update\Download\canadian hardcore masturbation stockings .mpeg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Microsoft\Temp\british cumshot [bangbus] penetration .mpeg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Common Files\microsoft shared\asian fetish [milf] legs mature .zip.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\handjob fucking [free] .avi.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\porn fucking several models balls .mpg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\indian lesbian catfight young .zip.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian cumshot hot (!) vagina boots .mpg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\african beastiality public .rar.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\bukkake hardcore hidden titts (Curtney).avi.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\spanish kicking voyeur girly .avi.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\bukkake trambling girls latex .mpg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\gang bang blowjob sleeping .mpeg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\swedish horse full movie (Sylvia,Ashley).rar.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Google\Temp\nude action big cock high heels .avi.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fetish hidden 50+ .mpg.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\mssrv.exe 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 3316 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 4552 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2052 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 89 PID 2344 wrote to memory of 2052 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 89 PID 2344 wrote to memory of 2052 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 89 PID 2344 wrote to memory of 4552 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 90 PID 2344 wrote to memory of 4552 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 90 PID 2344 wrote to memory of 4552 2344 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 90 PID 2052 wrote to memory of 3316 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 91 PID 2052 wrote to memory of 3316 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 91 PID 2052 wrote to memory of 3316 2052 511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
-
C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"C:\Users\Admin\AppData\Local\Temp\511a8fb8f5f2f7f0a6de2d4608a164ee080fad337d0ebabd8860b8136781b742.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\spanish kicking voyeur girly .avi.exe
Filesize153KB
MD59ccf3d780186ea0e3e60a2aa5aa4225d
SHA18acbb3c970cae2af0ca9e42464ec8a9587c86a99
SHA256de48163502dc9bb4f6322b0e1b9c8f621893f2932c0a6554386aaf2e6ff1c0f1
SHA512513f5fcbe03fe70479a7873925e916e8dd5d00e1c3618cd07a321f1eda7cff367cdd2b49be91192d7adc0fb59707dabe4c8d6e32272358b159e2b315a03a2a48