Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/04/2024, 19:21

General

  • Target

    21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe

  • Size

    385KB

  • MD5

    1510c7e79d87db55f1a78fbc9349ad14

  • SHA1

    b8e0ea6ea4da8c22a56acbe968d2b3d530be4859

  • SHA256

    21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b

  • SHA512

    7131a2a990f0dc77f5aa8c67e135317e6cc1146834ade0c443d2cb727e380abbc38b251e55d79970fedb0e88cd3058b0dc04ffc87c96004d20f1a77af6ef88cc

  • SSDEEP

    6144:dXC4vgmhbIxs3NBB/EM4D7sJ5XyeY9+BpTNoSJ3/6bY0wAqMQ+vM0vi0ipad4O6i:dXCNi9BGMJ7nVF/60kqMVrvirs59

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
    "C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
      "C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe
        "C:\Users\Admin\AppData\Local\Temp\21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1836

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\microsoft shared\lesbian full movie feet (Sandy,Sylvia).mpeg.exe

          Filesize

          1.9MB

          MD5

          1d29952cd372fbece9f22944f3c4d116

          SHA1

          ae25625bcd24834f4e19457d1bd3b14ddb278aee

          SHA256

          58de123f1cb3efc1f3840557db6ae92b87c60558b08e31143c58a93e0b3ea767

          SHA512

          b60ee6db46a565a6cf70d9ab76e673d39ed2da988e24a711c51a900eef7ba02f797188d9fea80b54b5145d717ead84d7db9a3026ded7616683e9f1edb0f4bcd7

        • memory/1836-79-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/2588-42-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/2588-78-0x0000000004F20000-0x0000000004F4B000-memory.dmp

          Filesize

          172KB

        • memory/3028-0-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/3028-39-0x0000000005010000-0x000000000503B000-memory.dmp

          Filesize

          172KB