Overview

overview

10

Static

static

10

60b5d2bb93...05.exe

windows7-x64

9

60b5d2bb93...05.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-04-2024 22:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe

  • Size

    1.7MB

  • MD5

    312417dd927b9b3f45e999491988e406

  • SHA1

    b7b44555df914045902c3f550c71f8a0651145c5

  • SHA256

    60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805

  • SHA512

    d40a2ff8f9bf91680a2fe557a4fb7b31fd3428231bbc66b7908ed4dfc9ff2057694a72b1eb5e205b8e35b0f4f760f257d39a8b0209ee474850d0ed7d8f3f70da

  • SSDEEP

    49152:xfyV9cRc3kpgIMExQ5NtLxM/YHcUrkq1i591H53rNXZOPrh+:xKV9ca3k2lrxMgHcUrfMHV3OPrh+

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 17 IoCs
  • UPX dump on OEP (original entry point) 20 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe
    "C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1004
    • C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe
      "C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe
        "C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1616
    • C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe
      "C:\Users\Admin\AppData\Local\Temp\60b5d2bb930a02666cce41387b99e741c217ef7a6d1c96672eeb1d75dfe2e805.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian gang bang gay several models glans gorgeoushorny (Karin).mpeg.exe
    Filesize

    1.0MB

    MD5

    1fa60f06b82861a160e2aee7de81ca01

    SHA1

    33e9eb84748a0bf1de8b07b20c7738e106708f73

    SHA256

    8cdd5052d4f3361cb7e9bf5a05a1677569a8e8e3a125a18ccf81326cd910416a

    SHA512

    623dba45e7134d87842752b481608e6138108943e97cef94dc85f5745b0fe1dc5ee92a14f4707e9ad9e49619858785a77ba45715d0b6761dfd3d495f91b97dcb

    Download Submit

  • memory/640-154-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/640-10-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-216-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-203-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-240-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-230-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-170-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-183-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-191-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-195-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-199-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-140-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-207-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-212-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-0-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-220-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1004-224-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1616-169-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2264-167-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download