Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 09:27
Static task
static1
Behavioral task
behavioral1
Sample
2a95da6136e35a81cbd596c909286255c36b42ea23288.exe
Resource
win7-20240221-en
General
-
Target
2a95da6136e35a81cbd596c909286255c36b42ea23288.exe
-
Size
312KB
-
MD5
fe1fa198626701a72893c05b5e3c7d0c
-
SHA1
830e5b629fec1cc2a532f6fe733efb1190c9cde5
-
SHA256
2a95da6136e35a81cbd596c909286255c36b42ea23288ac39bf7e5777f3c26ce
-
SHA512
34806c5779ceeb207df9253c5bd59b89bccb89c6ec1e09ad45d39588d5463c736169afee3ba499a6e44df47b8ee265c7be71eb274e6522ce5d4bd5a7ce976c96
-
SSDEEP
3072:gF1QsEr0pvCuuf1WzaLjh+U0+8N8r760loh7ofE0Fwdn+TGS8fKMr4UHEIFeI7Ir:MmoE4ho76zhU5wR+Tlft8EIFe1d
Malware Config
Extracted
stealc
http://185.172.128.62
-
url_path
/902e53a07830e030.php
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2a95da6136e35a81cbd596c909286255c36b42ea23288.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2a95da6136e35a81cbd596c909286255c36b42ea23288.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2a95da6136e35a81cbd596c909286255c36b42ea23288.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2a95da6136e35a81cbd596c909286255c36b42ea23288.exepid process 2336 2a95da6136e35a81cbd596c909286255c36b42ea23288.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2336-2-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/2336-1-0x0000000001B10000-0x0000000001C10000-memory.dmpFilesize
1024KB
-
memory/2336-3-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/2336-4-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/2336-7-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/2336-6-0x0000000001B10000-0x0000000001C10000-memory.dmpFilesize
1024KB
-
memory/2336-8-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/2336-11-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/2336-14-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB
-
memory/2336-18-0x0000000000400000-0x0000000001A19000-memory.dmpFilesize
22.1MB