Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
General
-
Target
8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe
-
Size
303KB
-
MD5
91741bece1c208576d07141d73428af5
-
SHA1
d8eb6088c0cc195106bc74635174901f67cbad2f
-
SHA256
8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b
-
SHA512
01bf797cb2e2afcb9517eaecf4df3352a28d9b2616c9e3ace900eec9ed3e38f91db80b5b7d9822995ccb0ba427bcd77f8004b59005b6854998d5f6f926ceed8e
-
SSDEEP
6144:QSdImzAVQiI+WjFDfoY9+6s6Be/ODsTnJyQlnutn:DcQiHmNJLB9unmn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2764 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.sho -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created C:\Windows\SysWOW64\Shohdi.hdi 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{6B474DC5-7E11-4523-8A72-1F3CDFB0B314}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSREC.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateCore.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Java\Java Update\jucheck.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdate.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.sho 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4460 wrote to memory of 2764 4460 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe 87 PID 4460 wrote to memory of 2764 4460 8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe"C:\Users\Admin\AppData\Local\Temp\8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.shoC:\Users\Admin\AppData\Local\Temp\8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.sho2⤵
- Executes dropped EXE
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b.sho
Filesize241KB
MD53052548c3fba7473d5a4eecf2c59c3ec
SHA1eaefaeb0b0b24f7ea2c706a06cbf081aafad7c72
SHA25666adbdbd251a5b9c37bc1448952e56e99c3b4ab7893aebdac0662ed987f24781
SHA512570e9186096568b85fc94194264f874d9dc55249f6ef6c00031eec8924bd8977549cef57d8657b9d84c01fbec9335608f14c9c6677573c11e9d33deb8bb8b545
-
Filesize
303KB
MD591741bece1c208576d07141d73428af5
SHA1d8eb6088c0cc195106bc74635174901f67cbad2f
SHA2568b3e07ca55a5f5f295579dc0a89d7018e95ce243e7e70aeae69e0dd694587c0b
SHA51201bf797cb2e2afcb9517eaecf4df3352a28d9b2616c9e3ace900eec9ed3e38f91db80b5b7d9822995ccb0ba427bcd77f8004b59005b6854998d5f6f926ceed8e