Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 11:45

General

  • Target

    BleachBit-Portable/bleachbit.exe

  • Size

    39KB

  • MD5

    5b00e9f5daa52e101d49b05f263f34cd

  • SHA1

    e9abf8544fcd5083c68d45e24253805f2a21f1f4

  • SHA256

    9d87edf4e1fe91ea98d45bd867071c826407b79ab013017e68b11f8bae37aa46

  • SHA512

    643445b2bc1caf8ff18a5be2382a206566aca20f472a7c3e68e8c13bcfed66db8a9d3f11bcf9efc2f47e199265c4493eafdeb549942d13d9e9b2bdbb2ecb00ba

  • SSDEEP

    192:yfQG9DrqrcQf7iUiEaux1Yx/CUnSrXca31vbpKbcOF918avi22MwftaRR1s37cU:NG1ercMHiENYB/KXxFv8bHgfERRm3V

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\bleachbit.exe
    "C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\bleachbit.exe"
    1⤵
      PID:2488

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\BleachBit-Portable\BleachBit.ini

            Filesize

            265B

            MD5

            19bd06917e7e0bd0a955b404460ccd23

            SHA1

            bf97f9991394fc3ca9bde9a7b598ef9f847a1d1d

            SHA256

            c255b17a6eef269f8011f69724927941d343b2b433489130ec45c564dad70fcc

            SHA512

            fe7b039e0bce6887b787005a22a556d359b836184b8c2c37da95dbfd95d8e1624b08a2861ac402c8d58006971bde578df9e7e8b9ff84d5c84f5735b9f16316fd

          • memory/2488-0-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

          • memory/2488-1-0x000000001E000000-0x000000001E24F000-memory.dmp

            Filesize

            2.3MB

          • memory/2488-2-0x00000000685C0000-0x00000000686D8000-memory.dmp

            Filesize

            1.1MB

          • memory/2488-6-0x0000000068DC0000-0x0000000068DEA000-memory.dmp

            Filesize

            168KB

          • memory/2488-7-0x0000000064740000-0x0000000064940000-memory.dmp

            Filesize

            2.0MB

          • memory/2488-5-0x000000006A900000-0x000000006A91A000-memory.dmp

            Filesize

            104KB

          • memory/2488-4-0x0000000065C40000-0x0000000065C51000-memory.dmp

            Filesize

            68KB

          • memory/2488-3-0x000000006A300000-0x000000006A327000-memory.dmp

            Filesize

            156KB

          • memory/2488-8-0x0000000002600000-0x00000000026FE000-memory.dmp

            Filesize

            1016KB

          • memory/2488-9-0x000000006A800000-0x000000006A87E000-memory.dmp

            Filesize

            504KB

          • memory/2488-11-0x0000000068F40000-0x0000000068F67000-memory.dmp

            Filesize

            156KB

          • memory/2488-16-0x000000006D4C0000-0x000000006D4D7000-memory.dmp

            Filesize

            92KB

          • memory/2488-15-0x000000006DD00000-0x000000006DD10000-memory.dmp

            Filesize

            64KB

          • memory/2488-14-0x0000000065340000-0x000000006537C000-memory.dmp

            Filesize

            240KB

          • memory/2488-13-0x000000006C340000-0x000000006C405000-memory.dmp

            Filesize

            788KB

          • memory/2488-18-0x000000006B280000-0x000000006B29A000-memory.dmp

            Filesize

            104KB

          • memory/2488-20-0x0000000061A00000-0x0000000061A38000-memory.dmp

            Filesize

            224KB

          • memory/2488-19-0x0000000063A40000-0x0000000063A92000-memory.dmp

            Filesize

            328KB

          • memory/2488-17-0x000000006D700000-0x000000006D742000-memory.dmp

            Filesize

            264KB

          • memory/2488-12-0x0000000062E80000-0x0000000062EA2000-memory.dmp

            Filesize

            136KB

          • memory/2488-22-0x0000000065580000-0x00000000655C9000-memory.dmp

            Filesize

            292KB

          • memory/2488-21-0x000000006D580000-0x000000006D661000-memory.dmp

            Filesize

            900KB

          • memory/2488-10-0x0000000064F80000-0x0000000064FBE000-memory.dmp

            Filesize

            248KB

          • memory/2488-23-0x0000000002700000-0x0000000002AF6000-memory.dmp

            Filesize

            4.0MB

          • memory/2488-24-0x0000000062940000-0x0000000062966000-memory.dmp

            Filesize

            152KB

          • memory/2488-28-0x0000000065880000-0x00000000658A8000-memory.dmp

            Filesize

            160KB

          • memory/2488-29-0x0000000061DC0000-0x0000000061DCF000-memory.dmp

            Filesize

            60KB

          • memory/2488-27-0x0000000068180000-0x00000000681C0000-memory.dmp

            Filesize

            256KB

          • memory/2488-26-0x000000006B8C0000-0x000000006B912000-memory.dmp

            Filesize

            328KB

          • memory/2488-25-0x00000000002A0000-0x00000000002BD000-memory.dmp

            Filesize

            116KB

          • memory/2488-30-0x000000001E8C0000-0x000000001E8E0000-memory.dmp

            Filesize

            128KB

          • memory/2488-31-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

            Filesize

            156KB

          • memory/2488-33-0x0000000010000000-0x000000001004F000-memory.dmp

            Filesize

            316KB

          • memory/2488-34-0x0000000000400000-0x0000000000419000-memory.dmp

            Filesize

            100KB

          • memory/2488-35-0x000000001E000000-0x000000001E24F000-memory.dmp

            Filesize

            2.3MB

          • memory/2488-32-0x00000000033C0000-0x000000000342D000-memory.dmp

            Filesize

            436KB

          • memory/2488-37-0x000000001E800000-0x000000001E84E000-memory.dmp

            Filesize

            312KB

          • memory/2488-36-0x00000000685C0000-0x00000000686D8000-memory.dmp

            Filesize

            1.1MB

          • memory/2488-42-0x0000000068DC0000-0x0000000068DEA000-memory.dmp

            Filesize

            168KB

          • memory/2488-54-0x0000000002600000-0x00000000026FE000-memory.dmp

            Filesize

            1016KB

          • memory/2488-56-0x000000006C340000-0x000000006C405000-memory.dmp

            Filesize

            788KB

          • memory/2488-59-0x000000006A900000-0x000000006A91A000-memory.dmp

            Filesize

            104KB

          • memory/2488-61-0x000000001EA40000-0x000000001EA72000-memory.dmp

            Filesize

            200KB

          • memory/2488-63-0x0000000068F40000-0x0000000068F67000-memory.dmp

            Filesize

            156KB

          • memory/2488-70-0x000000006B280000-0x000000006B29A000-memory.dmp

            Filesize

            104KB

          • memory/2488-69-0x000000006D700000-0x000000006D742000-memory.dmp

            Filesize

            264KB

          • memory/2488-74-0x0000000065580000-0x00000000655C9000-memory.dmp

            Filesize

            292KB

          • memory/2488-73-0x0000000061A00000-0x0000000061A38000-memory.dmp

            Filesize

            224KB

          • memory/2488-72-0x0000000063A40000-0x0000000063A92000-memory.dmp

            Filesize

            328KB

          • memory/2488-71-0x000000006D580000-0x000000006D661000-memory.dmp

            Filesize

            900KB

          • memory/2488-68-0x000000006D4C0000-0x000000006D4D7000-memory.dmp

            Filesize

            92KB

          • memory/2488-67-0x000000006DD00000-0x000000006DD10000-memory.dmp

            Filesize

            64KB

          • memory/2488-66-0x000000001EBF0000-0x000000001EC00000-memory.dmp

            Filesize

            64KB

          • memory/2488-65-0x0000000065340000-0x000000006537C000-memory.dmp

            Filesize

            240KB

          • memory/2488-64-0x0000000062E80000-0x0000000062EA2000-memory.dmp

            Filesize

            136KB

          • memory/2488-62-0x0000000064F80000-0x0000000064FBE000-memory.dmp

            Filesize

            248KB

          • memory/2488-58-0x0000000003570000-0x000000000357F000-memory.dmp

            Filesize

            60KB

          • memory/2488-57-0x000000001D1A0000-0x000000001D1B9000-memory.dmp

            Filesize

            100KB

          • memory/2488-55-0x000000006A800000-0x000000006A87E000-memory.dmp

            Filesize

            504KB

          • memory/2488-43-0x0000000064740000-0x0000000064940000-memory.dmp

            Filesize

            2.0MB

          • memory/2488-41-0x0000000002C90000-0x0000000002CA5000-memory.dmp

            Filesize

            84KB

          • memory/2488-40-0x0000000065C40000-0x0000000065C51000-memory.dmp

            Filesize

            68KB

          • memory/2488-39-0x000000006A300000-0x000000006A327000-memory.dmp

            Filesize

            156KB

          • memory/2488-38-0x000000001EA10000-0x000000001EA35000-memory.dmp

            Filesize

            148KB

          • memory/2488-82-0x000000001E000000-0x000000001E24F000-memory.dmp

            Filesize

            2.3MB

          • memory/2488-83-0x000000006A900000-0x000000006A91A000-memory.dmp

            Filesize

            104KB

          • memory/2488-84-0x00000000685C0000-0x00000000686D8000-memory.dmp

            Filesize

            1.1MB

          • memory/2488-85-0x000000006A300000-0x000000006A327000-memory.dmp

            Filesize

            156KB

          • memory/2488-87-0x0000000068DC0000-0x0000000068DEA000-memory.dmp

            Filesize

            168KB

          • memory/2488-88-0x0000000063A40000-0x0000000063A92000-memory.dmp

            Filesize

            328KB

          • memory/2488-89-0x0000000064740000-0x0000000064940000-memory.dmp

            Filesize

            2.0MB

          • memory/2488-90-0x0000000002600000-0x00000000026FE000-memory.dmp

            Filesize

            1016KB

          • memory/2488-101-0x000000006D4C0000-0x000000006D4D7000-memory.dmp

            Filesize

            92KB

          • memory/2488-100-0x0000000065580000-0x00000000655C9000-memory.dmp

            Filesize

            292KB

          • memory/2488-99-0x000000006DD00000-0x000000006DD10000-memory.dmp

            Filesize

            64KB

          • memory/2488-103-0x000000006B280000-0x000000006B29A000-memory.dmp

            Filesize

            104KB

          • memory/2488-97-0x0000000065340000-0x000000006537C000-memory.dmp

            Filesize

            240KB

          • memory/2488-104-0x0000000002700000-0x0000000002AF6000-memory.dmp

            Filesize

            4.0MB

          • memory/2488-96-0x000000006C340000-0x000000006C405000-memory.dmp

            Filesize

            788KB

          • memory/2488-111-0x000000001E8C0000-0x000000001E8E0000-memory.dmp

            Filesize

            128KB

          • memory/2488-113-0x00000000033C0000-0x000000000342D000-memory.dmp

            Filesize

            436KB

          • memory/2488-115-0x0000000010000000-0x000000001004F000-memory.dmp

            Filesize

            316KB

          • memory/2488-118-0x0000000060900000-0x0000000060975000-memory.dmp

            Filesize

            468KB

          • memory/2488-124-0x0000000062D40000-0x0000000062D58000-memory.dmp

            Filesize

            96KB

          • memory/2488-122-0x0000000003570000-0x000000000357F000-memory.dmp

            Filesize

            60KB