Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:21
Static task
static1
Behavioral task
behavioral1
Sample
b7dee59b78126ab03b18c571b7045e2c6b14606227046.exe
Resource
win7-20240419-en
General
-
Target
b7dee59b78126ab03b18c571b7045e2c6b14606227046.exe
-
Size
203KB
-
MD5
60de9c3b301760961bf1664166ef0899
-
SHA1
baa84500caf3d32d99fea3e34c7f1d4ccecbf0a3
-
SHA256
b7dee59b78126ab03b18c571b7045e2c6b146062270463d150cbe82ad86f2947
-
SHA512
15c74ad5cbb775c22d487e0db7cb0d9857fbe1ef7c52870cb291d63e59872e2fa5dac61b73b6c96ec9f037cd7dc16424f1c46a52ff32a0bb3113ed32c4bfe737
-
SSDEEP
3072:P3w5UJlGMHmApaf6MCTQOjenfCvV3WX7n1PD52Rb6ORB:P3w5U3psfMTQ8xvVGX7n1PYl6OR
Malware Config
Extracted
stealc
http://185.172.128.76
-
url_path
/8681490a59ad0e34.php
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
b7dee59b78126ab03b18c571b7045e2c6b14606227046.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b7dee59b78126ab03b18c571b7045e2c6b14606227046.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b7dee59b78126ab03b18c571b7045e2c6b14606227046.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b7dee59b78126ab03b18c571b7045e2c6b14606227046.exepid process 992 b7dee59b78126ab03b18c571b7045e2c6b14606227046.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/992-1-0x0000000002C50000-0x0000000002D50000-memory.dmpFilesize
1024KB
-
memory/992-2-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/992-3-0x0000000000400000-0x0000000002AF0000-memory.dmpFilesize
38.9MB
-
memory/992-4-0x0000000000400000-0x0000000002AF0000-memory.dmpFilesize
38.9MB
-
memory/992-5-0x0000000002C50000-0x0000000002D50000-memory.dmpFilesize
1024KB
-
memory/992-9-0x0000000000400000-0x0000000002AF0000-memory.dmpFilesize
38.9MB
-
memory/992-13-0x0000000000400000-0x0000000002AF0000-memory.dmpFilesize
38.9MB
-
memory/992-17-0x0000000000400000-0x0000000002AF0000-memory.dmpFilesize
38.9MB