Overview

overview

10

Static

static

10

ad25a9ca7e...7e.exe

windows7-x64

10

ad25a9ca7e...7e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2024, 23:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ad25a9ca7ec4475dc6fa3b50d4da92936bf0aff10eb2394e2cba5c56e59a787e.exe
  • Size 386KB
  • Sample240321-27dgracg76
  • SHA256 ad25a9ca7ec4475dc6fa3b50d4da92936bf0aff10eb2394e2cba5c56e59a787e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarepersistencestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Detects executables built or packed with MPress PE compressor 7 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Drops file in Drivers directory 4 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 38 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad25a9ca7ec4475dc6fa3b50d4da92936bf0aff10eb2394e2cba5c56e59a787e.exe
    "C:\Users\Admin\AppData\Local\Temp\ad25a9ca7ec4475dc6fa3b50d4da92936bf0aff10eb2394e2cba5c56e59a787e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      PID:3000
    • C:\Users\Admin\AppData\Local\Temp\ad25a9ca7ec4475dc6fa3b50d4da92936bf0aff10eb2394e2cba5c56e59a787e.exe
      C:\Users\Admin\AppData\Local\Temp\ad25a9ca7ec4475dc6fa3b50d4da92936bf0aff10eb2394e2cba5c56e59a787e.exe
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:476

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cftmon.exe
        • Path C:\Users\Admin\Local Settings\Application Data\cftmon.exe
        • Size 413KB
        • SHA256 7fc2205f2c2e77268834a737b78bd49a3bdb44252d6bac4ca802392591a2809f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 415KB
        • SHA256 80ab2aaadc8c89a51147e7ed72fb4d4f014d5a82c4114e64958b07569bbd63e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        spools.exe
        • Path C:\Windows\SysWOW64\drivers\spools.exe
        • Size 401KB
        • SHA256 c90cf6b2c47ba3268133ce4eb61bf0b01a3bb476348996d98c6284ab27a72d30
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        stop
        • Path \??\c:\stop
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        memory/476-5-0x0000000000400000-0x0000000000434000-memory.dmp
        Download

        memory/476-18-0x0000000000400000-0x0000000000434000-memory.dmp
        Download

        memory/968-0-0x0000000000400000-0x0000000000434000-memory.dmp
        Download

        memory/968-9-0x0000000000400000-0x0000000000434000-memory.dmp
        Download