Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe
Resource
win10v2004-20240426-en
General
-
Target
032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe
-
Size
455KB
-
MD5
9eca82d1ff4bee0b79fb73fd9e333a93
-
SHA1
cdeb36f8dbbf6bc4ef1fba4e33e4d39a7d5e8fdb
-
SHA256
032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672
-
SHA512
c70160b2ed7ac3dae0830536de5f2cbf8c3d36b402654d6a7cebcb64a9a49d47023ad0f83ee88057ec845571addfa46839773554e31d06986e26c58db5c893e2
-
SSDEEP
12288:KLxNI8KjYJK+N5VS+9HTA8gbqk8PP/OsmeMVKsvEfg0+H:KVNYjYJK+d+mk6/Opnv30S
Malware Config
Signatures
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
resource yara_rule behavioral1/memory/2244-1-0x0000000063080000-0x00000000631EC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2244-59-0x0000000003760000-0x00000000037C9000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Detects executables containing base64 encoded User Agent 2 IoCs
resource yara_rule behavioral1/memory/2244-1-0x0000000063080000-0x00000000631EC000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent behavioral1/memory/2244-59-0x0000000003760000-0x00000000037C9000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe SearchHelper.exe -
Executes dropped EXE 4 IoCs
pid Process 2520 SearchHelper.exe 2700 com3.exe 1724 SearchHelper.exe 1364 com3.exe -
Loads dropped DLL 7 IoCs
pid Process 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel GPU = "F:\\Program Files\\Intel GPU\\GfxUI.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Search Helper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Search\\SearchHelper.exe" com3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 3020 reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 2520 SearchHelper.exe 2700 com3.exe 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 1724 SearchHelper.exe 1364 com3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2520 SearchHelper.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2520 SearchHelper.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2520 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 28 PID 2244 wrote to memory of 2520 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 28 PID 2244 wrote to memory of 2520 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 28 PID 2244 wrote to memory of 2520 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 28 PID 2244 wrote to memory of 2700 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 29 PID 2244 wrote to memory of 2700 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 29 PID 2244 wrote to memory of 2700 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 29 PID 2244 wrote to memory of 2700 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 29 PID 2244 wrote to memory of 2392 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 30 PID 2244 wrote to memory of 2392 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 30 PID 2244 wrote to memory of 2392 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 30 PID 2244 wrote to memory of 2392 2244 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 30 PID 2392 wrote to memory of 1724 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 31 PID 2392 wrote to memory of 1724 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 31 PID 2392 wrote to memory of 1724 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 31 PID 2392 wrote to memory of 1724 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 31 PID 2392 wrote to memory of 1364 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 32 PID 2392 wrote to memory of 1364 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 32 PID 2392 wrote to memory of 1364 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 32 PID 2392 wrote to memory of 1364 2392 032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe 32 PID 2700 wrote to memory of 3020 2700 com3.exe 35 PID 2700 wrote to memory of 3020 2700 com3.exe 35 PID 2700 wrote to memory of 3020 2700 com3.exe 35 PID 2700 wrote to memory of 3020 2700 com3.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe"C:\Users\Admin\AppData\Local\Temp\032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /t REG_SZ /v "Intel GPU" /d "F:\Program Files\Intel GPU\GfxUI.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:3020
-
-
-
C:\Users\Admin\AppData\Local\Temp\032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe"C:\Users\Admin\AppData\Local\Temp\032d4c4b1bdbe8436a608cacb2e2d6bbc88828b7d4d1408f363ac0a70055d672.exe" silent pause2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Search\SearchHelper.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
-
C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"\\.\C:\Users\Admin\AppData\Local\Temp\WER9mso.dir00\com3.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1364
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10B
MD58b549bc054dae822ecbb803f3490e5f5
SHA109402858d1610e448f0aeb3788cf3317e8f0cb83
SHA2560762a04e018c81e349b8dd71d9589562e3d49cfa98dc9921acdab54bf3084d77
SHA5127a75ba404c7d031298d722e92373bf8878fe4e728911a414dc69ad654f0470f04b99e8ad4f1f1e56c7a9cbdb959ef6a9c581bc9e7f8eea86b4a758dfd45d4dd3
-
Filesize
458KB
MD5fa328ef5b76c4794371033972b661a4e
SHA1ffe66c819fc8a8d1801489156c1d2f4cc2c72ab1
SHA256139990f7535ff8af2016ddefc4d81a5c1a0cb42672d8c29cb9b6b1f2a05e9151
SHA512e468d556afac5f938fe92485a11d5591b91b157cc835f749c86a4b1e31b38e561dd58f39060ec0db6d0fd50c806aeaa07a139fc29e557b7ba6bc2decf21738d6
-
Filesize
458KB
MD5549ce443b478baabad0e7d5f3a25af5a
SHA1f44953870d97850a1239d15630499c2b52d8c107
SHA2560494b19e9e71ea17232971abc69e493baf799aab486044ef16a7a5eda1fa3ddf
SHA51276ea08012074b5615810693adc171e502272ff81f054faaaa8632f9db0c7b29b7305c0ac283ecc9abb87ee8edc7bed177cd6bbb1bc6ca63782662a625bd33509