Analysis
-
max time kernel
114s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:16
Static task
static1
Behavioral task
behavioral1
Sample
f85ca7da4201921c93b98f6555f3d7b7.exe
Resource
win7-20240220-en
General
-
Target
f85ca7da4201921c93b98f6555f3d7b7.exe
-
Size
226KB
-
MD5
f85ca7da4201921c93b98f6555f3d7b7
-
SHA1
523891e3e23bb45a52e402b6282f70f9e17cde9c
-
SHA256
eeaa177b0bc2d85cf8b416c2ed3b85fd50bd7c811bf41a32d161a10a767c2fda
-
SHA512
1b8220fe954799fbc43a702a1c508beff390c3f5a58e8e50e3c5ccce48459ec3a25df395f041f722cb67b0eb6c31013239f58a8b947e60344d15ce0c56e9cb17
-
SSDEEP
3072:kpvTZ/uFMUVza2N0PHPJvIHtI0Eo8552iIwuNLuB:kpvT0Za2N0PxMtI0ENiiIZNLu
Malware Config
Extracted
stealc
http://185.172.128.62
-
url_path
/902e53a07830e030.php
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3308 908 WerFault.exe f85ca7da4201921c93b98f6555f3d7b7.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
f85ca7da4201921c93b98f6555f3d7b7.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f85ca7da4201921c93b98f6555f3d7b7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f85ca7da4201921c93b98f6555f3d7b7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f85ca7da4201921c93b98f6555f3d7b7.exepid process 908 f85ca7da4201921c93b98f6555f3d7b7.exe 908 f85ca7da4201921c93b98f6555f3d7b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f85ca7da4201921c93b98f6555f3d7b7.exe"C:\Users\Admin\AppData\Local\Temp\f85ca7da4201921c93b98f6555f3d7b7.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 13082⤵
- Program crash
PID:3308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 908 -ip 9081⤵PID:2964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/908-1-0x00000000009B0000-0x0000000000AB0000-memory.dmpFilesize
1024KB
-
memory/908-3-0x0000000000400000-0x000000000083A000-memory.dmpFilesize
4.2MB
-
memory/908-2-0x00000000008C0000-0x00000000008E7000-memory.dmpFilesize
156KB
-
memory/908-4-0x0000000000400000-0x000000000083A000-memory.dmpFilesize
4.2MB
-
memory/908-5-0x00000000009B0000-0x0000000000AB0000-memory.dmpFilesize
1024KB
-
memory/908-7-0x0000000000400000-0x000000000083A000-memory.dmpFilesize
4.2MB
-
memory/908-9-0x0000000000400000-0x000000000083A000-memory.dmpFilesize
4.2MB
-
memory/908-11-0x0000000000400000-0x000000000083A000-memory.dmpFilesize
4.2MB
-
memory/908-13-0x0000000000400000-0x000000000083A000-memory.dmpFilesize
4.2MB