Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/04/2024, 18:40

General

  • Target

    0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe

  • Size

    425KB

  • MD5

    1d18f9631b672a1ae46add784f948ad2

  • SHA1

    865fb09938eb0d0448b64e4f9dfdd4f660bd5c22

  • SHA256

    0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930

  • SHA512

    ed3576b54774db6ac61a3b7b2011c8cede65b9e5b01b3983e5c52dc48ab5704b020120e3437e0ca0951950dede542c8764fb6898c3bb677e25c3e95c24a2868c

  • SSDEEP

    6144:aDOxZXrSHXUTsmYAWPrY+03KuC2gFb7zD/vQMzqWkCEAydaHZ3kFe5RimDoD5Zrb:lXa8sKWPZvhDAJWFry85ue7iSoDrkS1f

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 18 IoCs
  • UPX dump on OEP (original entry point) 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
    "C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
      "C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe
        "C:\Users\Admin\AppData\Local\Temp\0ebfc416ec6c16040cc766e8826cc19b67bd56ee65132eda5377abe7a4c5d930.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2484

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Windows Sidebar\Shared Gadgets\danish hardcore masturbation mistress .mpeg.exe

          Filesize

          888KB

          MD5

          570c8d81d9598a005d5161de45d8c03d

          SHA1

          9cf94f481bfb4522cbbabed7eeca803da9d6c63b

          SHA256

          f6bcaac2584d7ceae9564ac94ff2999912e8f7b755c337a7ac2d0b672d3b6ce7

          SHA512

          9d47560e089c4f5cffd1e44adcb06715401be8a207e6d35bd29e4a09b136de66f15dc038839cafa34c495316fb1478e290145f72ae0c64599f4416a2791e5cbc

        • C:\debug.txt

          Filesize

          183B

          MD5

          c4c77a1d575703f34fdc812cb03a3d85

          SHA1

          ec8d857a9abaf49b8d9f885a1e9fd682e3cdc948

          SHA256

          d29bf559b68b76cbed639f36028b39f5bae2a962f9e9a1a87e69def708d6b538

          SHA512

          fd9a31f646d38eb2b74d0e639f8e706e99b69028e5307fa591414ce32098fcfe836b7afedaf94dcc76a794cf808440f90a1d443891814628ad0c31e859217fdf

        • memory/2068-80-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2068-6-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2068-53-0x00000000045A0000-0x00000000045BC000-memory.dmp

          Filesize

          112KB

        • memory/2068-94-0x00000000045A0000-0x00000000045BC000-memory.dmp

          Filesize

          112KB

        • memory/2144-95-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-124-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-89-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-90-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-91-0x0000000004A50000-0x0000000004A6C000-memory.dmp

          Filesize

          112KB

        • memory/2144-141-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-0-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-98-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-101-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-105-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-110-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-5-0x0000000004A50000-0x0000000004A6C000-memory.dmp

          Filesize

          112KB

        • memory/2144-121-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-67-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-127-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-130-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-135-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2144-138-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB

        • memory/2484-54-0x0000000000400000-0x000000000041C000-memory.dmp

          Filesize

          112KB