Overview

overview

7

Static

static

3

nazavod cl...ta.exe

windows10-1703-x64

7

Resubmissions

06/04/2024, 16:34

240406-t2756sec9t7

03/04/2024, 16:29

240403-tzjpssfd9x7

03/04/2024, 16:23

240403-tvzkfsfg287

03/04/2024, 16:18

240403-tr6jlafd5z7

Analysis

  • max time kernel
    81s
  • max time network
    75s
  • platform
    windows10-1703_x64
  • resource
    win10-20240214-de
  • resource tags

    arch:x64arch:x86image:win10-20240214-delocale:de-deos:windows10-1703-x64systemwindows
  • submitted
    03/04/2024, 16:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nazavod claimer beta.exe
  • Size 10.6MB
  • Sample240403-tzjpssfd9x
  • SHA256 7ab2afb310b7081d95fdf35c15796e22b32f5fa03d3f0be9a41622348224c691
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nazavod claimer beta.exe
    "C:\Users\Admin\AppData\Local\Temp\nazavod claimer beta.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Users\Admin\AppData\Local\Temp\nazavod claimer beta.exe
      "C:\Users\Admin\AppData\Local\Temp\nazavod claimer beta.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:996

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\VCRUNTIME140.dll
          • Size 94KB
          • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\_bz2.pyd
          • Size 78KB
          • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\_ctypes.pyd
          • Size 117KB
          • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\_hashlib.pyd
          • Size 57KB
          • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\_lzma.pyd
          • Size 149KB
          • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\_tkinter.pyd
          • Size 60KB
          • SHA256 336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\_uuid.pyd
          • Size 20KB
          • SHA256 c74aaeec487457139b47c0ab56e01922bfae6debef562800e5b9b6baf1ec9d6a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _helpers.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\aiohttp\_helpers.cp310-win_amd64.pyd
          • Size 53KB
          • SHA256 5221391fa47ac3180ab77c5d3b9a15fc8c8087a5bd531daf47c3a4fecffc00b9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _http_parser.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\aiohttp\_http_parser.cp310-win_amd64.pyd
          • Size 248KB
          • SHA256 94eca40f1d8dfbbbdeff185a006925b4da53a7c86c2c3bc126110ab21bcedfe4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _http_writer.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\aiohttp\_http_writer.cp310-win_amd64.pyd
          • Size 48KB
          • SHA256 225f61a5e5b19f4320370523fd28e7166d3a65c69505a807573d9a18da641450
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\base_library.zip
          • Size 1.0MB
          • SHA256 6a08708c344f197da8efbe11eb47c2697a4858f13657c21d6bce58baec48c2c7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\certifi\cacert.pem
          • Size 285KB
          • SHA256 7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\charset_normalizer\md.cp310-win_amd64.pyd
          • Size 10KB
          • SHA256 9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md__mypyc.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\charset_normalizer\md__mypyc.cp310-win_amd64.pyd
          • Size 117KB
          • SHA256 ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _frozenlist.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\frozenlist\_frozenlist.cp310-win_amd64.pyd
          • Size 84KB
          • SHA256 5c204f6966526af4dc0c0d6d29909b6f088c4fa781464f2948414d833b03094d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\libssl-1_1.dll
          • Size 678KB
          • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\python310.dll
          • Size 4.2MB
          • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\tcl86t.dll
          • Size 1.8MB
          • SHA256 224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\tcl\encoding\cp1252.enc
          • Size 1KB
          • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
          • MD5 SHA1 SHA512
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI51162\tk86t.dll
          • Size 1.5MB
          • SHA256 bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _asyncio.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\_asyncio.pyd
          • Size 59KB
          • SHA256 cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _overlapped.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\_overlapped.pyd
          • Size 44KB
          • SHA256 fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\_queue.pyd
          • Size 26KB
          • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\_socket.pyd
          • Size 72KB
          • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ssl.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\_ssl.pyd
          • Size 152KB
          • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _websocket.cp310-win_amd64.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\aiohttp\_websocket.cp310-win_amd64.pyd
          • Size 35KB
          • SHA256 07e09075ef5a1bf2969381a5cadf07cdd1892b67ce7b6f643b5225f06d57e19f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _multidict.cp310-win_amd64.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\multidict\_multidict.cp310-win_amd64.pyd
          • Size 45KB
          • SHA256 74ec52418c5d38a63add94228c6f68cf49519666ae8bcb7ac199f7d539d8612c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pyarmor_runtime.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\pyarmor_runtime_000000\pyarmor_runtime.pyd
          • Size 619KB
          • SHA256 1540a00102611e506a16e8142f245e7c7a7ad50dc5c11fa1ad20c8b4b3b8e36c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\select.pyd
          • Size 25KB
          • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unicodedata.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\unicodedata.pyd
          • Size 1.1MB
          • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _quoting_c.cp310-win_amd64.pyd
          • Path \Users\Admin\AppData\Local\Temp\_MEI51162\yarl\_quoting_c.cp310-win_amd64.pyd
          • Size 93KB
          • SHA256 eefb46501ef97baf29a93304f58674e70f5ccecafb183f230e5ce7872a852f56
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1276-1028-0x0000000061CC0000-0x0000000061D69000-memory.dmp
          Download