windealer | 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Size

364KB
MD5

cc7207f09a6fe41c71626ad4d3f127ce
SHA1

84e749c37978f9387e16fab29c7b1b291be93a63
SHA256

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa
SHA512

c7f236f1bafa9192ba30f40b6cbc0e74c89a5b4d7ae95fa98d1ace3857849ba37d2211a2c42bb4f348bd218e1ce28a7006bbda07e3e1e51c09a806da17f9f655
SSDEEP

6144:FrbPUOKGKoeokhUj6UNOuGAT0EWkxKthr97veIHyqxiRix0jpuqVcM3B:dTULGKoBkhUj6G6eKT9DeCS3qaB

Score

10^/10

windealer stealer trojan

Malware Config

Signatures

Detect WinDealer information stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2668-0-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral1/memory/2668-5-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer

WinDealer
WinDealer is an info stealer used by LuoYu group.
stealer trojan windealer

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

pid	Process
2668	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
2668	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
"C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-0-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/2668-5-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download