9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
Size

146KB
MD5

9545e8a080381140085125fda930f84a
SHA1

8a8bcd8432f253b5ef9f7a65693d0073c9c0ac66
SHA256

9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993
SHA512

610a6c63db5eb5e2c1689979c7090bcbdcc7719720f15092aef518477c379a44f6dc43ff8cbdde1acedd976998d97ba856a5c66ee68520d4984f273fdbe3b42b
SSDEEP

3072:wCh9E1ZEFTBxITXBwwtglACjXo92tJzp/GpP6kvjnmeg6rce5v7LsqF:wCOZwsRztgJXnepCijnVg6L5v8+

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
856	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\L:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\H:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\M:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\P:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\R:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\T:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\Y:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\Z:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\A:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\I:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\J:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\Q:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\U:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\V:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\X:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\B:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\G:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\K:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\N:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\O:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\S:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
File opened (read-only)	\??\W:	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe

C:\Users\Admin\AppData\Local\Temp\9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe
"C:\Users\Admin\AppData\Local\Temp\9654845c3d6c99952ad1d88c68983efa80523ba02eb913f1ec3be9cea4060993.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\GLC1297.tmp

Filesize
156KB

MD5
7b4571f62cac828b19e77d2a048a3501

SHA1
f1a20a73802d437882596e11a8478ac67951cd73

SHA256
6a21254f3840e3029598a7fd018f685772646a9f657ce13d98a6af8e76915626

SHA512
29f4ec3e46a91dd57b3328c1744eba5e4cd8f48bf9b91328bc89692d0cb722e9b84516d9854b17b98ff8ea8604f07fbc81afe9ae0ccd59afdb74a4692d546e37

Download Submit