Analysis
-
max time kernel
291s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-04-2024 10:26
General
-
Target
08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe
-
Size
5.7MB
-
MD5
4e660043e7b682e7e07e512cb1c79681
-
SHA1
f1cb193f47bf5365340857d7d02a69c70dafd0ad
-
SHA256
08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f
-
SHA512
31f03a196a5aca0c8e01c872cd1e1a2f4082d1a588bb9dab04509c079e98fbf175c957647248458f33df63ce662f755a3a5b15ae5057befd32676785791eda69
-
SSDEEP
49152:3BzVPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dr:3/KUgTH2M2m9UMpu1QfLczqssnKSk
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a11AD.bat3⤵
- Deletes itself
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
484KB
MD579d4fd1cb70f3844796aa1ea18a238e2
SHA178d207a7de2aeb85eefc185d894b0b7626e1e1f3
SHA256ccaacc3965c1bdfce8cd1e934895a4563dddf082016e56846966c250bed87d5b
SHA5127a0167cbce49f09ea39e490862b8c371eacf8ce3d74d6a6054e7f0e1df4b307019f5adee03603fcb9d4db2b17841cbc9cf129e9480d70b20c266fe82b3979b33
-
C:\Users\Admin\AppData\Local\Temp\$$a11AD.batFilesize
722B
MD54f18bd18f1e6a28926da5e9ddd0013db
SHA1caf0a1cea27251de6b005653e04a4b1c9c90fb3e
SHA2560618a6fcfc25a16209afa92db832c3e3d2baa714a37fdbfeb68ef91d9553aa69
SHA512c22af4e1c8a0d177877b59593a066539d75a4c201c66b5cc3db8975dbd2482edf0f8ce0b47bb9c064142e353b824945dc347e4eddfe7be517d62900176c59e22
-
C:\Users\Admin\AppData\Local\Temp\08daf59a4e1d26485cb64a89f7300eaf9a492145510078e6d9fa0016c1816b6f.exe.exeFilesize
5.7MB
MD5ba18e99b3e17adb5b029eaebc457dd89
SHA1ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA256f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
SHA5121f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
-
C:\Windows\Logo1_.exeFilesize
39KB
MD5e562a49de2a4fe02528334fb6bab74a7
SHA1f7fe5abfcc74025ccce004838f6691c9b065fda2
SHA256aa959e0bb3f9e45c50b690682cb03b3f8a26bac4e9b2484245b6428d9d41aefd
SHA512a4eabce52bd0a2fec53bfd83eb98e6446717e1ed6f3242e970a055bf2c7c7ea9423235c97c022031ff7fb1b7af0e650f543e932bb962d0e1246c60ca13008df5
-
F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\_desktop.iniFilesize
9B
MD5e7957b9f3d9556c996418169821a7993
SHA1b7028de0f91d2e50a8d5f6d23613331a2784a142
SHA25671a21a13d7822776d52d9a6146651dc9155db9f0bfbd978acf43d12dea2a8539
SHA51272bc8552047095449fa4c3c21300183acfc7b33e6ab69c11435542e2862cb9e896bbfdedaeb97ec6edac8ed68220507a302d1ed2217624c97f6e9a83c0d3a285
-
memory/1204-26-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/2040-30-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2040-17-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2040-3317-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2040-4140-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2040-4164-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2940-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2940-15-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB