Analysis
-
max time kernel
111s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe
Resource
win10v2004-20240419-en
General
-
Target
fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe
-
Size
306KB
-
MD5
80b6ab6a94be9f1cc5326fb7eafe8bc1
-
SHA1
177176a6d021829b3c9c5f4c56bd1818e49c7843
-
SHA256
fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc
-
SHA512
4838e8a2288dd343a6c4594096a0241ba843f0960f5e3c223bb14c3767672131a2326f2f60cbb0d6e1100ae8c7dfe2b9e26bd2eea2e7cfcab3707686d88a58d7
-
SSDEEP
3072:S5OGVnqRp2PCl0kRv+nbLkOvqDbDEKEJTsTc+ZlRVpRmHEzGI7IMNU:OmIPCLwHSvQJmhpRyEy8NU
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 756 4528 WerFault.exe fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exepid process 4528 fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe 4528 fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe"C:\Users\Admin\AppData\Local\Temp\fc78e8de8a0ef72dba38b06c7f884087a37db530035976a88a230fe0c683c4cc.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 11962⤵
- Program crash
PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4528 -ip 45281⤵PID:4608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4528-2-0x0000000001B30000-0x0000000001B57000-memory.dmpFilesize
156KB
-
memory/4528-1-0x0000000001BD0000-0x0000000001CD0000-memory.dmpFilesize
1024KB
-
memory/4528-3-0x0000000000400000-0x0000000001A18000-memory.dmpFilesize
22.1MB
-
memory/4528-4-0x0000000000400000-0x0000000001A18000-memory.dmpFilesize
22.1MB
-
memory/4528-5-0x0000000000400000-0x0000000001A18000-memory.dmpFilesize
22.1MB
-
memory/4528-6-0x0000000001BD0000-0x0000000001CD0000-memory.dmpFilesize
1024KB
-
memory/4528-9-0x0000000000400000-0x0000000001A18000-memory.dmpFilesize
22.1MB
-
memory/4528-11-0x0000000000400000-0x0000000001A18000-memory.dmpFilesize
22.1MB
-
memory/4528-13-0x0000000000400000-0x0000000001A18000-memory.dmpFilesize
22.1MB