Overview

overview

10

Static

static

10

bb30c47fc5...13.exe

windows7-x64

9

bb30c47fc5...13.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/04/2024, 02:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe

  • Size

    1.5MB

  • MD5

    db34d06bdc792af8e61257f1b9c82f91

  • SHA1

    5ec91f5872eaa0d1b74e35a94bdbb591d6b16a76

  • SHA256

    bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13

  • SHA512

    be8c6af21ca77a0ead29b12aabdc8c52654b836dd0cb29711929ea683227d717986f26c4cae5417d15616ccde2943c8b65154ef6b42302c8c5cf0539964fc356

  • SSDEEP

    24576:sWB3bTyvH7kCyvpZVyGvXOWG8gUmXKBADpbYluVsE3mMn8qKnFMp8G:BfhvfG8gUmXw4pbxnP8VFg/

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe
    "C:\Users\Admin\AppData\Local\Temp\bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe
      "C:\Users\Admin\AppData\Local\Temp\bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Users\Admin\AppData\Local\Temp\bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe
        "C:\Users\Admin\AppData\Local\Temp\bb30c47fc542a81ecb70117f791dcf7a7550c19627da2ebe7c1f5641644d8f13.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 356
      2⤵
      • Program crash
      PID:1568

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Windows Sidebar\Shared Gadgets\gang bang lingerie public .avi.exe
          Filesize

          804KB

          MD5

          651dc704e16b2f1706110f77f1cdd725

          SHA1

          24a2a53834e34901f654e7444a445e73cc18e2fc

          SHA256

          3c0a79fb2c5adcc9693223fa9c9a2187a3d213923373e3e8990cb72fc62d48ff

          SHA512

          fb1ea83e767605fa21e0b86f9f4dba9a6ca65165a210c3213174ebd538d5ffbed565aacd3dd6db92f07d7b5811b341407b6126aad5d4f87c7eeab92a09d9b65b

          Download Submit

        • C:\debug.txt
          Filesize

          183B

          MD5

          87211daf87364cde2869acee4fd1ebfe

          SHA1

          ef5faf7a9ce04c14892995ebf692d958149855ed

          SHA256

          712fbd87158b2162cb368178b4acd9e5d85bef3fffc9d53f7dc3e6c48916f022

          SHA512

          c9d84ba3e0b3bb2ff642fb67c978d726edb96769cc130af19e47a16fb8b4b7555d18ed788af225d1e4ddc880d71c3eb087b619ab43d623132fecfc4ef893c47e

          Download Submit