Analysis
-
max time kernel
134s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 10:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe
-
Size
878KB
-
MD5
e3ed0d3b6f801d8ffe8dc18b262c14c5
-
SHA1
a3c499d65a090b2df7fb519a9a366f4cb3d39f79
-
SHA256
506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f
-
SHA512
cc40b7f5e5acaecc3567635a4df4068f3f2d35253ff4db20dcdfcf8be98c3167643709173035980dd4030f338517c3b2f2cf12daadb5c45daf5b8094d6d48f34
-
SSDEEP
24576:dAHnh+eWsN3skA4RV1Hom2KXMmHau635:8h+ZkldoPK8Yaum
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\s: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\v: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\w: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\e: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\j: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\t: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\u: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\g: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\h: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\i: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\l: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\m: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\p: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\q: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\r: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\a: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\b: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\x: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\y: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\z: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\k: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe File opened (read-only) \??\o: 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2768 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 28 PID 1424 wrote to memory of 2768 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 28 PID 1424 wrote to memory of 2768 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 28 PID 1424 wrote to memory of 2768 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 28 PID 1424 wrote to memory of 2012 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 30 PID 1424 wrote to memory of 2012 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 30 PID 1424 wrote to memory of 2012 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 30 PID 1424 wrote to memory of 2012 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 30 PID 1424 wrote to memory of 2532 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 32 PID 1424 wrote to memory of 2532 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 32 PID 1424 wrote to memory of 2532 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 32 PID 1424 wrote to memory of 2532 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 32 PID 1424 wrote to memory of 2704 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 34 PID 1424 wrote to memory of 2704 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 34 PID 1424 wrote to memory of 2704 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 34 PID 1424 wrote to memory of 2704 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 34 PID 1424 wrote to memory of 2584 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 36 PID 1424 wrote to memory of 2584 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 36 PID 1424 wrote to memory of 2584 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 36 PID 1424 wrote to memory of 2584 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 36 PID 1424 wrote to memory of 2708 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 38 PID 1424 wrote to memory of 2708 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 38 PID 1424 wrote to memory of 2708 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 38 PID 1424 wrote to memory of 2708 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 38 PID 1424 wrote to memory of 2588 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 40 PID 1424 wrote to memory of 2588 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 40 PID 1424 wrote to memory of 2588 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 40 PID 1424 wrote to memory of 2588 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 40 PID 1424 wrote to memory of 2656 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 42 PID 1424 wrote to memory of 2656 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 42 PID 1424 wrote to memory of 2656 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 42 PID 1424 wrote to memory of 2656 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 42 PID 1424 wrote to memory of 2448 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 44 PID 1424 wrote to memory of 2448 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 44 PID 1424 wrote to memory of 2448 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 44 PID 1424 wrote to memory of 2448 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 44 PID 1424 wrote to memory of 1032 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 46 PID 1424 wrote to memory of 1032 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 46 PID 1424 wrote to memory of 1032 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 46 PID 1424 wrote to memory of 1032 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 46 PID 1424 wrote to memory of 2312 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 48 PID 1424 wrote to memory of 2312 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 48 PID 1424 wrote to memory of 2312 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 48 PID 1424 wrote to memory of 2312 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 48 PID 1424 wrote to memory of 1548 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 50 PID 1424 wrote to memory of 1548 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 50 PID 1424 wrote to memory of 1548 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 50 PID 1424 wrote to memory of 1548 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 50 PID 1424 wrote to memory of 564 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 52 PID 1424 wrote to memory of 564 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 52 PID 1424 wrote to memory of 564 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 52 PID 1424 wrote to memory of 564 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 52 PID 1424 wrote to memory of 816 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 54 PID 1424 wrote to memory of 816 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 54 PID 1424 wrote to memory of 816 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 54 PID 1424 wrote to memory of 816 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 54 PID 1424 wrote to memory of 2856 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 56 PID 1424 wrote to memory of 2856 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 56 PID 1424 wrote to memory of 2856 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 56 PID 1424 wrote to memory of 2856 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 56 PID 1424 wrote to memory of 2964 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 58 PID 1424 wrote to memory of 2964 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 58 PID 1424 wrote to memory of 2964 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 58 PID 1424 wrote to memory of 2964 1424 506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe"C:\Users\Admin\AppData\Local\Temp\506c90747976c4cc3296a4a8b85f388ab97b6c1cfae11096f95977641b8f8b6f.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:2768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:2012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A2⤵PID:2532
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.docx" /S /B /A2⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.docm" /S /B /A2⤵PID:2584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A2⤵PID:2708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:2588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:2656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xls" /S /B /A2⤵PID:2448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xlsx" /S /B /A2⤵PID:1032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xlsm" /S /B /A2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A2⤵PID:2856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A2⤵PID:2964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pptx" /S /B /A2⤵PID:876
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:2608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A2⤵PID:1880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A2⤵PID:1516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A2⤵PID:632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A2⤵PID:800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A2⤵PID:2784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A2⤵PID:1116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A2⤵PID:2804
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A2⤵PID:1344
-