Overview

overview

10

Static

static

10

0c5c5eaf9f...03.exe

windows7-x64

9

0c5c5eaf9f...03.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 18:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe

  • Size

    1.6MB

  • MD5

    bcefd26185cbc4ab0b9525652972913a

  • SHA1

    b2ceebe0a27abda967309b25d9b103698db40fca

  • SHA256

    0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803

  • SHA512

    7f0193ccce0f796b7eecc942d3661aecfaaf4c14d56782a0ec7a904a83584ea3a56ae0d0c9b3b5f93b71fc88f0bfe3231ed5af7e73f988fd2c6149634d54bbdd

  • SSDEEP

    24576:VYgK84mc3oQNtuGKJneIez3s+5OHOY+1WFfjchp33CVZsH1jelgS4AhKjiCq:in8zQKneI43958O71WGSVZsHggSHKj6

Score
9/10
persistencespywarestealerupx

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 11 IoCs
  • UPX dump on OEP (original entry point) 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe
    "C:\Users\Admin\AppData\Local\Temp\0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe
      "C:\Users\Admin\AppData\Local\Temp\0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Users\Admin\AppData\Local\Temp\0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe
        "C:\Users\Admin\AppData\Local\Temp\0c5c5eaf9f6b807bb514135d3f3b70de847b12f52fe36d97b9349e291bdbf803.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2228

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian trambling hidden .mpg.exe
    Filesize

    1.0MB

    MD5

    8dcec2c2cec03e3a1ae5cbea85d1442c

    SHA1

    af394332e87831ca9f639c22be3e9bbfa72bab71

    SHA256

    96eeeaf341448cb75990d3659f05cc9443700953366baa6513f9e955ccf0f365

    SHA512

    e970601c12f63cdd68ec8749c6e3c790821162c2dcc32336419032cf6fa084b5db85471b75a44c3184900cafaa47e6de539599a638a12c0478a5fef9e3f825c7

    Download Submit
  • C:\debug.txt
    Filesize

    183B

    MD5

    775ae00f8d5edfd628c0eb9c1f49ed1e

    SHA1

    712a4c77067ff9e09ece4668383d37e46f869666

    SHA256

    7c3fc79365d6e544574964b9bf824bdb7528a07b650c2819221fcf37adbe2a67

    SHA512

    c6840fe09a8182357b0bd75fe3c9165ea45e056ec1e880de0db0ff8b6aaed28813f96fa66bf26bdd0f458978d60c57643befd0402b3375d45ed1e4bbf6ecff64

    Download Submit
  • memory/2036-109-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-126-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-144-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-92-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-138-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-65-0x0000000004B70000-0x0000000004B8E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-105-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-132-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-0-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-115-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2036-123-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2228-90-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2228-104-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2488-95-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2488-108-0x0000000004580000-0x000000000459E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2488-66-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2488-89-0x0000000004580000-0x000000000459E000-memory.dmp
    Filesize

    120KB

    Download