Overview

overview

10

Static

static

10

95c929dba9...6d.exe

windows7-x64

9

95c929dba9...6d.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2024 01:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe

  • Size

    403KB

  • MD5

    7efc322d3f56b57d7945080144e08677

  • SHA1

    f9354f399ec1dd8e5495624868d65070bf0dd28e

  • SHA256

    95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d

  • SHA512

    00fb059caf212c5291d1945d989863c5715cf9178aae46c5fa52c49e5674e6a606d065e6ae166f4fbf93ce6adb736afacf7b8672be1e00f3e6c629644421ac76

  • SSDEEP

    6144:tjluQoSDIo5R4nM/40yJNV6dCVEl3o/HPJqcVcy6RDH3BKlVeC3JhneJIgEqO/Rg:tEQoS9qhHM8ElYvoyoDxuVeC3JhHJ1/C

Score
9/10
persistencespywarestealerupx

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 17 IoCs
  • UPX dump on OEP (original entry point) 20 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe
    "C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe
      "C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe
        "C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:916
    • C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe
      "C:\Users\Admin\AppData\Local\Temp\95c929dba97314c6c807f5963dd3ebdf4ee1fc123259447146288509cd8f5b6d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\swedish gang bang horse voyeur feet shower .mpg.exe
    Filesize

    1.5MB

    MD5

    b83af13483aa573a1ba49a0b32f3d080

    SHA1

    9510b0cc60d5521e76575273d4fff0e836e729a6

    SHA256

    37d0231c8c51b945f32d4db33ea37335bbd74033d6fa02b7e146aaf0eeb18957

    SHA512

    f0f4232f22daa1b1777e6f71abef11498d8844640dcf6cc7b364033054d4b22acdcc8f300b844b264dd76805f855b95c17a9396579ba738fd7cda982b9a3717a

    Download Submit

  • C:\debug.txt
    Filesize

    146B

    MD5

    f5eaaa0c97a9ff3a9bcf37c06566cbea

    SHA1

    cdba904628521117aa782f5e8dfee799206b39a5

    SHA256

    d600c389043b802fdb6472c22c5407096cd01894354481b28c6ec0c58098bd77

    SHA512

    99e5a5a5fc08c199407e6042dcbaee5c3e99276aea10df997d8a73badb48bddf4cd40cd03a163dabc0a34fc0c80e5c8bca9635210e3909059b7c349332e6d9ec

    Download Submit

  • memory/916-148-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/1340-13-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-186-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-221-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-249-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-190-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-191-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-198-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-245-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-212-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-217-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-0-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-225-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-229-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-233-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-237-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2500-241-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/3464-145-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download

  • memory/3464-188-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

    Download