Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 01:19
Behavioral task
behavioral1
Sample
c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe
Resource
win7-20240221-en
General
-
Target
c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe
-
Size
342KB
-
MD5
06de284be1d83d203ea8567c7360b90a
-
SHA1
e574bc9ee2721dfac3191f1622a8936fa9cf0424
-
SHA256
c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404
-
SHA512
66c6ddc9a1711368c15b542f039a2adbbb3a9988041caf9acb64de8341f8a563491097c4e93002b9e636a70ba3ce2102de063b6193ce05a09dde6b662dc67480
-
SSDEEP
6144:EaVWdyzOxeA1DfdwX3MmIOgwnlRi5nv1rOEFW7rBHC0n5xOyrXfDis07SXXHLNG3:EMROxdDfOnMmXNlRwvxLQ7rZlxXDfmAI
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5072-0-0x0000000000400000-0x0000000000446000-memory.dmp UPX behavioral2/memory/5072-76-0x0000000000400000-0x0000000000446000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/5072-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/5072-76-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Drops file in Program Files directory 6 IoCs
Processes:
setup-stub.exedescription ioc Process File opened for modification C:\Program Files\Mozilla Firefox\nsp4539.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsp453A.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsp4539.tmp\ setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsp453B.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsp453C.tmp setup-stub.exe File opened for modification C:\Program Files\Mozilla Firefox\nsp453B.tmp\ setup-stub.exe -
Executes dropped EXE 1 IoCs
Processes:
setup-stub.exepid Process 2252 setup-stub.exe -
Loads dropped DLL 7 IoCs
Processes:
setup-stub.exepid Process 2252 setup-stub.exe 2252 setup-stub.exe 2252 setup-stub.exe 2252 setup-stub.exe 2252 setup-stub.exe 2252 setup-stub.exe 2252 setup-stub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 3764 2252 WerFault.exe 86 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
setup-stub.exepid Process 2252 setup-stub.exe 2252 setup-stub.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exedescription pid Process procid_target PID 5072 wrote to memory of 2252 5072 c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe 86 PID 5072 wrote to memory of 2252 5072 c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe 86 PID 5072 wrote to memory of 2252 5072 c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe"C:\Users\Admin\AppData\Local\Temp\c6e62f27891318bd89fd04ad922073380567a73c53b8909725ffd18495305404.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\7zS0D3E0A47\setup-stub.exe.\setup-stub.exe2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 24803⤵
- Program crash
PID:3764
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2252 -ip 22521⤵PID:4144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
551KB
MD510645c44cc12751c5ef8c9209ec0490c
SHA1c30e9a731c47270d49d3c70a5fbc07f8a48eef50
SHA256d9c7beec1d4c5bada1980e95fc30fdde0fc18915b99a8a31f82342767757f11e
SHA512bcade43faf2818d92ee354acad2dfb3d0871e6995dae1e665fcfb8d8b33b69bc518f88338e4c8e8f5c62704dd4013cd0168a3a22214422c65a3b76f4e9b2e6e5
-
Filesize
53KB
MD52021acc65fa998daa98131e20c4605be
SHA12e8407cfe3b1a9d839ea391cfc423e8df8d8a390
SHA256c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
SHA512cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948
-
Filesize
17KB
MD597c607f5d0add72295f8d0f27b448037
SHA1dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c
SHA256dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5
SHA512ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268
-
Filesize
22KB
MD5b361682fa5e6a1906e754cfa08aa8d90
SHA1c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA256b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
SHA5122778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
-
Filesize
28KB
MD5d23b256e9c12fe37d984bae5017c5f8c
SHA1fd698b58a563816b2260bbc50d7f864b33523121
SHA256ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
SHA51213f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e
-
Filesize
14KB
MD5610ad03dec634768cd91c7ed79672d67
SHA1dc8099d476e2b324c09db95059ec5fd3febe1e1e
SHA256c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
SHA51218c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd
-
Filesize
103KB
MD5b53cd4ad8562a11f3f7c7890a09df27a
SHA1db66b94670d47c7ee436c2a5481110ed4f013a48
SHA256281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
SHA512bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81
-
Filesize
1KB
MD51cb97b5f8c5f2728b26742d1d0669899
SHA1bb5ab1b8c00810fcb18184a996573c5accdc72c3
SHA256dec82e9caa154300e1aa44f550c16b455a2025be4fb1c3155cb75fe04a6b6611
SHA512768ed2b070485f3bbcf457aefdc0ef8f1737ad8ac4a2703e2feaff424f9a2c69a2f5928a3be898932ef4976a44ea829a099d090bd9941a24d045d5c8ac8b7b43
-
Filesize
1KB
MD5d845e8f4c0edb3cab17e6a30090ac5b8
SHA1654f058570f0868f0acc5f0595147f3385a9c265
SHA2561adcfdd9768242c6c639b10e4f0bcda24f6a957a169c1dede265e40336ecbd4f
SHA512401d800c484b74401b90c3285d8b6cc0018baf4979d6ec7bb174f7810d3f60adfa6b4cebeafcee20d5a7c3597447f755af19c5fecf1863e2438fe427dbdf9fed
-
Filesize
815B
MD5efce3dce0165b3f6551db47e5c0ac8d6
SHA11e15f6bb688e3d645092c1aa5ee3136f8de65312
SHA256dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e
SHA512cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988