604d2a693634ed16a6d84f446ca7d208408f57e87ec30f35a577c27e2cc542f7

Analysis

max time kernel
66s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 13:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

micify-stealer-main4.21/micify-stealer-main/Waltuhium.py
Size

142KB
MD5

a68c266b695985a653e227a9db3f0cc3
SHA1

cab667616ad48f7ff006334083fc8ce70fd98a58
SHA256

6c8fbec69a8d070cb00f253fc9886e620034733038b2307779b2026559d3fa0b
SHA512

9d958551dfcecd763c3c8e98273c06db76248547c4774ec90188bff0ac4779582c1228735663b9503f2e7058cb60743344bc1c85d26d0cfe45df6338755c6928
SSDEEP

1536:eiYj57SAiFZjpKNrwne+HAz6v5QnsOkZdaC12JNsLqDhC/+0M/K6U5ftN:87JWGwFgZ6daC2JNs+C/+fyVN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4472 OpenWith.exe

pid	process
4472	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\micify-stealer-main4.21\micify-stealer-main\Waltuhium.py
1⤵
- Modifies registry class
PID:4508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads