Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-04-2024 20:16

General

  • Target

    3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe

  • Size

    296KB

  • MD5

    51258dfe210d9a83658eaf57b548ae2e

  • SHA1

    077a592b96af2c9ca3f97e2e146a2b5cdffd77d9

  • SHA256

    3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1

  • SHA512

    d941055062b14280df28f67c3cd12c7d2c84ce8f6bbc1c7034d64ca9a9d8183ebdf6c46f760f64ba83acdae2a9122f80a23f0e07024c48a3004099155fb7044b

  • SSDEEP

    6144:YjluQoSPIo5R4nM/40yJNt8WKjvpvN9h/iJvV9Ga74UMvdudpVGRP:YEQoSpqh/8Vjvpl9hm9Ga74Xv+VGRP

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 5 IoCs
  • UPX dump on OEP (original entry point) 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe
    "C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe
      "C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe
        "C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2388
    • C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe
      "C:\Users\Admin\AppData\Local\Temp\3cdd779d90c951bb8be19635ca5aba89002c6f834ffd42993aaf2e0fb4df00f1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Sidebar\Shared Gadgets\sperm catfight hairy .zip.exe

    Filesize

    1.3MB

    MD5

    d8c8c5461863f04c16027abf4584233f

    SHA1

    9a34df78ffc026236a52784547f36b31365933b8

    SHA256

    5beba572836cc8552565bf89c3499163f717ea62f3c446a9e4c17f30db822704

    SHA512

    5fa2ce5009b713c43e47c579401d98a4dffbb61290ee311f39c875ea0f9ac509213eaaaeef55295a0d8dfbcf712a213134671c17c87fc399632748f06d529304

  • C:\debug.txt

    Filesize

    183B

    MD5

    859275ad25c590dce05595eabbd85745

    SHA1

    59922c42cfc6ded0eef86aacf7c8f2505765bc83

    SHA256

    4422c3ba60bf357911cece6c9d0c5b7ea31598b894dd59364946244e14fc6deb

    SHA512

    3f8470a69bf8e4c656f5121229f00827f9a4bd28599c5db41e57abc5b1fbb3af38cf1c356cb502c743f297474d727fedc9ae1509cfe7ddcc9b3856c28f4b9bf1

  • memory/2388-56-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2448-58-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2448-105-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2520-9-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2520-55-0x00000000047C0000-0x00000000047E0000-memory.dmp

    Filesize

    128KB

  • memory/2520-101-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2520-102-0x00000000047C0000-0x00000000047E0000-memory.dmp

    Filesize

    128KB

  • memory/2612-57-0x0000000004A90000-0x0000000004AB0000-memory.dmp

    Filesize

    128KB

  • memory/2612-97-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2612-99-0x0000000004890000-0x00000000048B0000-memory.dmp

    Filesize

    128KB

  • memory/2612-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2612-8-0x0000000004890000-0x00000000048B0000-memory.dmp

    Filesize

    128KB