Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 11:03
Static task
static1
Behavioral task
behavioral1
Sample
56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe
Resource
win7-20240221-en
General
-
Target
56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe
-
Size
697KB
-
MD5
a31cb445d3131bf567720c43f2a74484
-
SHA1
29e763a59424f9bb147df11a7b2ebfe9373a451f
-
SHA256
56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256
-
SHA512
ca8d1c63ababcb662922d4e91c3f599579ce324881ca4ce6effe942b91037012fc959060eab730d62b07330c17bd4ac49458b52c224c5e615ee55ae469ae0ae0
-
SSDEEP
12288:4ld5Utx2MeMB+iCe161fWM1BRBcD9l7lYmpU1g6l47YlAEWJHk0mlRX:4zMMMe25CeMfhvRGxagcgGkJH3mlRX
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exedescription ioc process File opened (read-only) \??\b: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\n: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\p: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\w: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\o: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\r: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\t: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\a: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\e: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\j: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\k: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\m: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\u: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\x: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\y: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\g: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\h: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\i: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\q: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\v: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\l: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\s: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe File opened (read-only) \??\z: 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1084-2-0x0000000000270000-0x000000000034D000-memory.dmp autoit_exe behavioral1/memory/1084-3-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-4-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-7-0x0000000000270000-0x000000000034D000-memory.dmp autoit_exe behavioral1/memory/1084-8-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-10-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-12-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-14-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-16-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe behavioral1/memory/1084-18-0x0000000000400000-0x0000000000A88000-memory.dmp autoit_exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exedescription pid process target process PID 1084 wrote to memory of 2244 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2244 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2244 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2244 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2308 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2308 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2308 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2308 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2432 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2432 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2432 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2432 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2832 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2832 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2832 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2832 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2848 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2848 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2848 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2848 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2576 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2576 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2576 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2576 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2700 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2700 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2700 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2700 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2548 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2548 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2548 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2548 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2556 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2556 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2556 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2556 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2376 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2376 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2376 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2376 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 1936 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 1936 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 1936 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 1936 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2464 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2464 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2464 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2464 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2380 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2380 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2380 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2380 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2764 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2764 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2764 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2764 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2084 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2084 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2084 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 2084 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 920 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 920 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 920 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe PID 1084 wrote to memory of 920 1084 56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe"C:\Users\Admin\AppData\Local\Temp\56731c777896837782beff4432330486a941e4f3af44b4d24be7c62c16e96256.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A2⤵PID:2244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A2⤵PID:2308
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:2432
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:2832
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A2⤵PID:2848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:2576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:2700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:2548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A2⤵PID:2556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A2⤵PID:2376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A2⤵PID:1936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A2⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A2⤵PID:2380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A2⤵PID:2764
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A2⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A2⤵PID:920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A2⤵PID:1200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1084-1-0x0000000000C20000-0x0000000000D20000-memory.dmpFilesize
1024KB
-
memory/1084-2-0x0000000000270000-0x000000000034D000-memory.dmpFilesize
884KB
-
memory/1084-3-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-4-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-6-0x0000000000C20000-0x0000000000D20000-memory.dmpFilesize
1024KB
-
memory/1084-7-0x0000000000270000-0x000000000034D000-memory.dmpFilesize
884KB
-
memory/1084-8-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-10-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-12-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-14-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-16-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB
-
memory/1084-18-0x0000000000400000-0x0000000000A88000-memory.dmpFilesize
6.5MB