Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 11:48
Static task
static1
Behavioral task
behavioral1
Sample
707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe
Resource
win7-20240221-en
General
-
Target
707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe
-
Size
728KB
-
MD5
2124d2e449117ecbc66c3e67e3ed289c
-
SHA1
5455fb1f943ec04431c69857806de4a7a0625eb3
-
SHA256
707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473
-
SHA512
3af0af3136fc4e0dc8558fdce4de0faf8c0b15e78ee96df1c0b2903b5d8bfcc717c1cdd20f5fd15f375651b3c22289b621192cd4dc9973e8c173a661011c718c
-
SSDEEP
12288:Sf26fr9vINi7CaxdAiaKVBVLXidyJoHAPCzBegCIiZlV0CSnfAsD7Q/voA:StJvIIFKU3MA2A6zINPVzSfWoA
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exedescription ioc process File opened (read-only) \??\a: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\b: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\j: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\m: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\u: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\v: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\e: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\l: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\r: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\z: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\g: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\i: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\n: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\p: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\w: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\x: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\h: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\k: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\o: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\q: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\s: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\t: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe File opened (read-only) \??\y: 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/5088-2-0x0000000005A50000-0x0000000005B2D000-memory.dmp autoit_exe behavioral2/memory/5088-3-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe behavioral2/memory/5088-6-0x0000000005A50000-0x0000000005B2D000-memory.dmp autoit_exe behavioral2/memory/5088-7-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe behavioral2/memory/5088-9-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe behavioral2/memory/5088-11-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe behavioral2/memory/5088-13-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe behavioral2/memory/5088-15-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe behavioral2/memory/5088-18-0x0000000000400000-0x0000000003E18000-memory.dmp autoit_exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exedescription pid process target process PID 5088 wrote to memory of 744 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 744 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 744 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1676 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1676 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1676 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1576 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1576 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1576 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3812 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3812 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3812 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1892 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1892 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1892 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1476 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1476 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1476 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4024 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4024 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4024 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4972 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4972 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4972 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 2560 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 2560 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 2560 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4900 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4900 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4900 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3192 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3192 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3192 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 5080 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 5080 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 5080 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4760 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4760 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 4760 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3112 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3112 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 3112 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 2940 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 2940 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 2940 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1784 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1784 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 1784 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 5012 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 5012 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe PID 5088 wrote to memory of 5012 5088 707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe"C:\Users\Admin\AppData\Local\Temp\707971879e65cbd70fd371ae76767d3a7bff028b56204ca64f27e93609c8c473.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A2⤵PID:744
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A2⤵PID:1676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A2⤵PID:1576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A2⤵PID:1892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A2⤵PID:1476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A2⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A2⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A2⤵PID:2560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A2⤵PID:4900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A2⤵PID:3192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A2⤵PID:5080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A2⤵PID:4760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A2⤵PID:3112
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A2⤵PID:2940
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A2⤵PID:1784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A2⤵PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5088-1-0x0000000003E70000-0x0000000003F70000-memory.dmpFilesize
1024KB
-
memory/5088-2-0x0000000005A50000-0x0000000005B2D000-memory.dmpFilesize
884KB
-
memory/5088-3-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB
-
memory/5088-5-0x0000000003E70000-0x0000000003F70000-memory.dmpFilesize
1024KB
-
memory/5088-6-0x0000000005A50000-0x0000000005B2D000-memory.dmpFilesize
884KB
-
memory/5088-7-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB
-
memory/5088-9-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB
-
memory/5088-11-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB
-
memory/5088-13-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB
-
memory/5088-15-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB
-
memory/5088-18-0x0000000000400000-0x0000000003E18000-memory.dmpFilesize
58.1MB