Overview

overview

10

Static

static

10

5df541c431...7e.exe

windows7-x64

9

5df541c431...7e.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 22:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe

  • Size

    805KB

  • MD5

    21f668cd5bf72bd77a66477d6432dc63

  • SHA1

    be3c9f5853281ba260e2ae20fb847678cd0e23d8

  • SHA256

    5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e

  • SHA512

    4efba9e574d597e15c51f3d2fcde90519add6ecfbc3bbd680413b72ee7c40210f2f807d4a671a68f81deec145e1b5b637245fdf3324aab6ac04f5726371b1640

  • SSDEEP

    12288:VEQoSfqpstwMNEjbyIEijxj4699Pchggr3tBX+072NxPyWNP6b4SoeSQMv7bZabZ:V42g54a9P2r3n5G7PObSQMfMGsd/tZ9

Score
9/10
persistencespywarestealerupx

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 21 IoCs
  • UPX dump on OEP (original entry point) 23 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe
    "C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe
      "C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe
        "C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1056
    • C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe
      "C:\Users\Admin\AppData\Local\Temp\5df541c4311a14239efbc4b12cd1631f7e65b9ac825fb0c956536d2776749c7e.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Sidebar\Shared Gadgets\horse horse hidden feet sweet .avi.exe
    Filesize

    448KB

    MD5

    166af0f6540f1f3b1b8fe3e300d9cfa5

    SHA1

    1d47736aec745057971afcc13fd8925e909da770

    SHA256

    b1f9467073cf3e796093a1092f7e9f693a3d7b9f84231263a00e180e6a60927e

    SHA512

    65e8ce2a04d866dbc1b72c70b9073a4d6348fb0117d152dec01265dc6dd1ecb1054f309b95cfea1eb8d7b7b10b752c7c564dcf7ec47d1e7ebe562fa1b3a941ed

    Download Submit

  • C:\debug.txt
    Filesize

    183B

    MD5

    0a763362b61e4b0c90088ea74c0282e7

    SHA1

    2c38a59962656b473aaf9e10b728f9890baa4877

    SHA256

    34e4a2ce93212aca6991dcaa26f57589365d08fec0a8fc27001980c8f5e85c11

    SHA512

    c21730c24fe307aa8fee00c9d81dfc46049d6a29fee43630f8f51e63b238ebfcd0d2a56c926dbbd4d3fceb81c2dea68d544a61c92333fc205e886838c8fd00ff

    Download Submit

  • memory/1056-57-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1056-95-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-126-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-134-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-160-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-93-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-156-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-12-0x0000000004F10000-0x0000000004F2E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-152-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-97-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-98-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-100-0x0000000004F10000-0x0000000004F2E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-104-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-108-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-148-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-122-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-0-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-130-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-144-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2148-140-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2396-56-0x00000000047D0000-0x00000000047EE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2396-13-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2396-94-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2500-96-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2500-58-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download