Analysis
-
max time kernel
111s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 02:31
Static task
static1
Behavioral task
behavioral1
Sample
6a1950539f96cbb2cf816a413a68e07f.exe
Resource
win7-20240221-en
General
-
Target
6a1950539f96cbb2cf816a413a68e07f.exe
-
Size
311KB
-
MD5
6a1950539f96cbb2cf816a413a68e07f
-
SHA1
6bff7074f3bfc7dfa00dd188ab8b620a8d986cc7
-
SHA256
aa26475eeea5b19d3d052637a9e988e0250ae16190807889fc255065687c8780
-
SHA512
be12aa463be7df2d66e6fbda1bb9eb783328b72e4b001904574d9541b9e13ad343e3e58f0febdf1196d39d69835b60a3bd475d3ed978945415f423c4fc0ef02d
-
SSDEEP
3072:t1K1Gr12pK4q+LM6B+uTzLzX0z1eQZvjOG7cZIORHw1zjyMwWF96ZYikkZ7ODE:6obaX5ykZBRQ1zjyM10YiJODE
Malware Config
Extracted
stealc
http://185.172.128.76
-
url_path
/8681490a59ad0e34.php
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2236 216 WerFault.exe 6a1950539f96cbb2cf816a413a68e07f.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
6a1950539f96cbb2cf816a413a68e07f.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6a1950539f96cbb2cf816a413a68e07f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6a1950539f96cbb2cf816a413a68e07f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6a1950539f96cbb2cf816a413a68e07f.exepid process 216 6a1950539f96cbb2cf816a413a68e07f.exe 216 6a1950539f96cbb2cf816a413a68e07f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a1950539f96cbb2cf816a413a68e07f.exe"C:\Users\Admin\AppData\Local\Temp\6a1950539f96cbb2cf816a413a68e07f.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 12642⤵
- Program crash
PID:2236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 216 -ip 2161⤵PID:4716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/216-2-0x0000000001C80000-0x0000000001CA7000-memory.dmpFilesize
156KB
-
memory/216-1-0x0000000001D20000-0x0000000001E20000-memory.dmpFilesize
1024KB
-
memory/216-3-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/216-4-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/216-5-0x0000000001D20000-0x0000000001E20000-memory.dmpFilesize
1024KB
-
memory/216-6-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/216-9-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/216-11-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/216-13-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB