Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30-04-2024 01:41
General
-
Target
441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb.exe
-
Size
749KB
-
MD5
a6479dae68115fad0a37c5fb33becf99
-
SHA1
398663b27c9297a884c800aa64916c976638a036
-
SHA256
441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb
-
SHA512
aa3dc1b98aa53708a2b9834fb3dc0585ae5deffa168fe65d2aff3d80f4b0849c41d3cbd37e306ac6bfbfe5689e8c625828c93453fd21d5f7ecc0b16ad85f7452
-
SSDEEP
12288:Cv2E2CrJF9srANfrX8QoN2e9YxzKapgg3e8SIa+9j8CfL6qd8kAXDbvDYD:jE2CrJdNfjrfJ+aX3e8DaOj8wL6e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb.exe"C:\Users\Admin\AppData\Local\Temp\441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FfJ3CHVJLN.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
-
C:\Users\Admin\System.exe"C:\Users\Admin\System.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5a78c5213dcbc62242a2345778a622205
SHA1c9ad35e46de6fd5eadb4349b734d5eb1f4850d3c
SHA25669322dbb2f8af8e844bb28836184c58aa57d2909af2d9e074981b804b62133f0
SHA5123d4181142573b694e1bb26c421f24eabee166dc609abd032d407c802674a56d1248d3afd0ed436dc4a651177c5e15a10a4afccbacd10809ddbeb7d8f39dbc142
-
Filesize
749KB
MD5a6479dae68115fad0a37c5fb33becf99
SHA1398663b27c9297a884c800aa64916c976638a036
SHA256441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb
SHA512aa3dc1b98aa53708a2b9834fb3dc0585ae5deffa168fe65d2aff3d80f4b0849c41d3cbd37e306ac6bfbfe5689e8c625828c93453fd21d5f7ecc0b16ad85f7452
-
Filesize
100KB
-
Filesize
96KB
-
Filesize
776KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
760KB
-
Filesize
10.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
100KB
-
Filesize
676KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB