Overview

overview

8

Static

static

3

73e3a97f36...da.exe

windows7-x64

8

73e3a97f36...da.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe
  • Size 66KB
  • Sample240407-xtbnsabg8y
  • SHA256 73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
spywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3560
      • C:\Users\Admin\AppData\Local\Temp\73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe
        "C:\Users\Admin\AppData\Local\Temp\73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:3040
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F25.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4624
            • C:\Users\Admin\AppData\Local\Temp\73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe
              "C:\Users\Admin\AppData\Local\Temp\73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe"
              4⤵
              • Executes dropped EXE
              PID:2052
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3120
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2304
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:4764
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3844
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:4476

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                GoogleUpdateCore.exe
                • Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
                • Size 258KB
                • SHA256 dee2cf210ee5f75549462b7cb03674155eb011190c77e332d53edcf655bcc237
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 577KB
                • SHA256 1371f108190c128f882a8babd65e575855c16a158530163f97d4aaec08204a3a
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                vcredist_x86.exe
                • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                • Size 488KB
                • SHA256 37cf90de70064c0ecf765ae35e8b0cf412c90cca2aaa2513cfba95b408b4e604
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                $$a6F25.bat
                • Path C:\Users\Admin\AppData\Local\Temp\$$a6F25.bat
                • Size 722B
                • SHA256 3a33c0ddfa522f3ad970cf5b57775da8148e15106f3eadcfc5807412feb7b38e
                • MD5 SHA1 SHA512
                Submit Download

                73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe.exe
                • Path C:\Users\Admin\AppData\Local\Temp\73e3a97f360d6000d2dc297dd4737b0f87239c60cb007c04b1ea468088b2bcda.exe.exe
                • Size 33KB
                • SHA256 9cbd9a06aba24333d873174149ca30fe5c64c767586cec1a3c833eb6880c53ee
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Logo1_.exe
                • Path C:\Windows\Logo1_.exe
                • Size 33KB
                • SHA256 7e4e7447ce04580a3af3a9bf90810712d6daebc0ced6c6856eae22771ac50956
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                hosts
                • Path C:\Windows\system32\drivers\etc\hosts
                • Size 842B
                • SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
                • MD5 SHA1 SHA512
                Submit Download

                _desktop.ini
                • Path F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\_desktop.ini
                • Size 8B
                • SHA256 2d3dbb80989e5cc7ef9ef800cc986bb8dccf4ca1f78437040bccd59312a55593
                • MD5 SHA1 SHA512
                Submit Download

                memory/3120-19-0x0000000000400000-0x000000000043E000-memory.dmp
                Download

                memory/3120-10-0x0000000000400000-0x000000000043E000-memory.dmp
                Download

                memory/3120-995-0x0000000000400000-0x000000000043E000-memory.dmp
                Download

                memory/3120-5292-0x0000000000400000-0x000000000043E000-memory.dmp
                Download

                memory/3120-8599-0x0000000000400000-0x000000000043E000-memory.dmp
                Download

                memory/4980-0-0x0000000000400000-0x000000000043E000-memory.dmp
                Download

                memory/4980-9-0x0000000000400000-0x000000000043E000-memory.dmp
                Download