Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 10:54
Static task
static1
Behavioral task
behavioral1
Sample
4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe
Resource
win7-20240221-en
General
-
Target
4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe
-
Size
4.9MB
-
MD5
3640ff45519f1acc1505348010626b6d
-
SHA1
d5b85fddbf7c893e50560da787d7bc0dcef658e9
-
SHA256
4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020
-
SHA512
6b407e7bfd9bdc7b4ab99b25ff810e547e38e29441b9e9fc224450d71a352789683b7096747daa98c114b65153c80fa857c538461a951432d9c20392b2c18486
-
SSDEEP
98304:D2X7i8AE3yWw+0wHhuEpvzmA9CQn4RNUBo003+RVIajg5I85CQJ:Y35yA9C/t0E+RKXI8P
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
AppLaunch.exedescription ioc process File opened (read-only) \??\n: AppLaunch.exe File opened (read-only) \??\p: AppLaunch.exe File opened (read-only) \??\w: AppLaunch.exe File opened (read-only) \??\x: AppLaunch.exe File opened (read-only) \??\e: AppLaunch.exe File opened (read-only) \??\l: AppLaunch.exe File opened (read-only) \??\k: AppLaunch.exe File opened (read-only) \??\m: AppLaunch.exe File opened (read-only) \??\o: AppLaunch.exe File opened (read-only) \??\t: AppLaunch.exe File opened (read-only) \??\u: AppLaunch.exe File opened (read-only) \??\y: AppLaunch.exe File opened (read-only) \??\a: AppLaunch.exe File opened (read-only) \??\i: AppLaunch.exe File opened (read-only) \??\z: AppLaunch.exe File opened (read-only) \??\s: AppLaunch.exe File opened (read-only) \??\g: AppLaunch.exe File opened (read-only) \??\j: AppLaunch.exe File opened (read-only) \??\q: AppLaunch.exe File opened (read-only) \??\r: AppLaunch.exe File opened (read-only) \??\v: AppLaunch.exe File opened (read-only) \??\b: AppLaunch.exe File opened (read-only) \??\h: AppLaunch.exe -
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4564-74-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-81-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-82-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-84-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-93-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-92-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-100-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-111-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-110-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-114-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-119-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-122-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/4564-126-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exedescription pid process target process PID 4256 set thread context of 4564 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 216 4256 WerFault.exe 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exepid process 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exeAppLaunch.exedescription pid process target process PID 4256 wrote to memory of 4564 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe AppLaunch.exe PID 4256 wrote to memory of 4564 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe AppLaunch.exe PID 4256 wrote to memory of 4564 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe AppLaunch.exe PID 4256 wrote to memory of 4564 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe AppLaunch.exe PID 4256 wrote to memory of 4564 4256 4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe AppLaunch.exe PID 4564 wrote to memory of 4416 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4416 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4416 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3192 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3192 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3192 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2748 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2748 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2748 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3948 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3948 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3948 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2964 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2964 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2964 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4588 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4588 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4588 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 1256 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 1256 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 1256 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4240 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4240 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4240 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2816 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2816 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2816 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3324 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3324 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3324 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 744 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 744 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 744 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3248 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3248 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3248 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2668 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2668 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2668 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3756 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3756 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3756 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2200 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2200 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 2200 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 452 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 452 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 452 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4712 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4712 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 4712 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3356 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3356 4564 AppLaunch.exe cmd.exe PID 4564 wrote to memory of 3356 4564 AppLaunch.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe"C:\Users\Admin\AppData\Local\Temp\4ee84419fb9267081480954f1be176095a45fe299078dfa95f980e513b46a020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A3⤵PID:4416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A3⤵PID:3192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A3⤵PID:2748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:3948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A3⤵PID:2964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A3⤵PID:4588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A3⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:4240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A3⤵PID:2816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A3⤵PID:3324
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A3⤵PID:744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A3⤵PID:3248
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A3⤵PID:2668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A3⤵PID:3756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A3⤵PID:2200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A3⤵PID:452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A3⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.txt" /S /B /A3⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 4442⤵
- Program crash
PID:216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4256 -ip 42561⤵PID:3260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4256-0-0x0000000000400000-0x0000000000986000-memory.dmpFilesize
5.5MB
-
memory/4256-1-0x0000000002670000-0x00000000026D0000-memory.dmpFilesize
384KB
-
memory/4256-4-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/4256-3-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/4256-2-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/4256-5-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/4256-6-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/4256-7-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/4256-8-0x0000000003770000-0x0000000003771000-memory.dmpFilesize
4KB
-
memory/4256-10-0x0000000000400000-0x0000000000986000-memory.dmpFilesize
5.5MB
-
memory/4256-11-0x0000000003760000-0x0000000003761000-memory.dmpFilesize
4KB
-
memory/4256-9-0x0000000003770000-0x0000000003771000-memory.dmpFilesize
4KB
-
memory/4256-13-0x0000000003760000-0x0000000003761000-memory.dmpFilesize
4KB
-
memory/4256-14-0x0000000003760000-0x0000000003761000-memory.dmpFilesize
4KB
-
memory/4256-16-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/4256-17-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-18-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/4256-22-0x0000000002A30000-0x0000000002A31000-memory.dmpFilesize
4KB
-
memory/4256-21-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-24-0x0000000002AE0000-0x0000000002AE1000-memory.dmpFilesize
4KB
-
memory/4256-25-0x0000000003880000-0x0000000003881000-memory.dmpFilesize
4KB
-
memory/4256-26-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-28-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-29-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-27-0x0000000000400000-0x0000000000986000-memory.dmpFilesize
5.5MB
-
memory/4256-23-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-20-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/4256-19-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-15-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-30-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-31-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-32-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-33-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-35-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-34-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-36-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-37-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-38-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-39-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-40-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-41-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-42-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-43-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-44-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-45-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-46-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-47-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-48-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-49-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-50-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-51-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-52-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-53-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-54-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-55-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-56-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-57-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-58-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-59-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-60-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-61-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-62-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-63-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-64-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-65-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-66-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-67-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-68-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-69-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-70-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-71-0x0000000003760000-0x0000000003860000-memory.dmpFilesize
1024KB
-
memory/4256-73-0x0000000000400000-0x0000000000986000-memory.dmpFilesize
5.5MB
-
memory/4256-102-0x0000000000400000-0x0000000000986000-memory.dmpFilesize
5.5MB
-
memory/4564-74-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-81-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-82-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-84-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-93-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-92-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-100-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-111-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-110-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-114-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-119-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-122-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/4564-126-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB