Overview

overview

8

Static

static

7

e692a90143...18.exe

windows7-x64

7

e692a90143...18.exe

windows10-2004-x64

3

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

7

$PLUGINSDI...ll.dll

windows10-2004-x64

7

$TEMP/Mail...te.exe

windows7-x64

8

$TEMP/Mail...te.exe

windows10-2004-x64

8

$TEMP/marker.exe

windows7-x64

1

$TEMP/marker.exe

windows10-2004-x64

1

SkyMonk.exe

windows7-x64

1

SkyMonk.exe

windows10-2004-x64

1

english.dll

windows7-x64

1

english.dll

windows10-2004-x64

1

filter.dll

windows7-x64

1

filter.dll

windows10-2004-x64

1

russian.dll

windows7-x64

1

russian.dll

windows10-2004-x64

1

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/04/2024, 03:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMP/MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
  • Size 3.8MB
  • Sample240408-eepyraga24
  • SHA256 da0e716af146e66e9e5aeeafc46ab2c2b81bc29fb800a2ac2816af537b03b240
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMP\MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMP\MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1712
    • C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe
      "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" /RegServer
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:3844
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe" ENABLE ALL
      2⤵
      • Modifies Windows Firewall
      PID:4456
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" "C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe" ENABLE ALL
      2⤵
      • Modifies Windows Firewall
      PID:3444
    • C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe
      "C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe" /INSTALL2 /LANG=ru /GUID={A31DBEB4-49DC-46FF-8F17-33E90BFA44AB}
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe
        "C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe" /gui
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3284
  • C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe
    "C:\Program Files (x86)\Mail.Ru\Guard\GuardMailRu.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    PID:1104
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2828

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MailRuSputnik.dll
          • Path C:\Program Files (x86)\Mail.Ru\Sputnik\MailRuSputnik.dll
          • Size 1.5MB
          • SHA256 460d1ec2f2019db2ab0c91f412c9ccda30d5266d9be3b8be8b0a9ccb9f2bc513
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SputnikFlashPlayer.exe
          • Path C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikFlashPlayer.exe
          • Size 700KB
          • SHA256 05cbbc5a40b8377b59fa02668af101dd7f7f62fc79a06ac4cea07277181d9292
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          SputnikHelper.exe
          • Path C:\Program Files (x86)\Mail.Ru\Sputnik\SputnikHelper.exe
          • Size 263KB
          • SHA256 0ebe401d1115c3d9568156f24e40843b0c710b18b54f2ee20627e72cf04dca9e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
          • Size 8KB
          • SHA256 f346b5496287e390c66e6ecc8b7372b7ae6fac7b659bfbb636b1c057f00e4536
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GuardMailRu.exe
          • Path C:\Users\Admin\AppData\Local\Temp\GuardMailRu.exe
          • Size 1.7MB
          • SHA256 2fe206942c8bb8789b19ca663dbdeb5a57eae513f5e8e6264902099bcfdc7bd1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          thumbnail_bg.png
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cx76qewj.Admin\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\tabs\thumbnail_bg.png
          • Size 162B
          • SHA256 539e5288dc16f987a223f3bb76a6ddd01a7ce75be796d679b09bc29c5cd85b4a
          • MD5 SHA1 SHA512
          Submit Download

          2_10.png
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cx76qewj.Admin\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\chrome\skin\weather\2_10.png
          • Size 3KB
          • SHA256 c7660d24b1239cc4a2a5d176a2c135ad104bbcbb904362297bb336de9f7a2bcf
          • MD5 SHA1 SHA512
          Submit Download

          prefs.js
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cx76qewj.Admin\prefs.js
          • Size 69B
          • SHA256 b31be1373b73fa6a04c5c1c51dea2211f016d509a7fbef6d2bfac1015449ac4c
          • MD5 SHA1 SHA512
          Submit Download

          install.rdf
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}\install.rdf
          • Size 1KB
          • SHA256 be86314e913facb86bcb10add8daba8a51208a5c82f77100fb8ed7b33cf89f05
          • MD5 SHA1 SHA512
          Submit Download

          prefs.js
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs.js
          • Size 6KB
          • SHA256 9394a1d5038ed5b10b0c671dd88f5b18f668fa09c448edb430ac196ab07afe4b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/3284-570-0x00000000009A0000-0x00000000009A1000-memory.dmp
          Download

          memory/3284-582-0x00000000009A0000-0x00000000009A1000-memory.dmp
          Download