Overview

overview

10

Static

static

10

c543d9ea22...04.exe

windows7-x64

9

c543d9ea22...04.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/05/2024, 03:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe

  • Size

    1.4MB

  • MD5

    2611feaeea39b9194997cf523779e2db

  • SHA1

    2ec2322c0524aa7af4425f4ea9b3a868605061ef

  • SHA256

    c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604

  • SHA512

    de0566d546483aa42e7d403c4e3fc2dbd180333e4bd90babf8e22d9c285efad573c1b6b996363cef06de659cdb67883b5fbd6cbcb7405539990bd9bb44cf0ab7

  • SSDEEP

    24576:NSLyVgfkzM8/MBpNLT6Z2+hXNIjryGYDxvCuL52XUIYHc0KD95ZbrGZ/EWqCaMNZ:NFVgCaplTolhXNIHcD0oUMmD/ZbrGNEg

Score
9/10
persistencespywarestealerupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe
    "C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe
      "C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe
        "C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2388
    • C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe
      "C:\Users\Admin\AppData\Local\Temp\c543d9ea22f699f7124dc9bcfaf7efa55d1a3dc94ea9053bbb5771ff8bf14604.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Sidebar\Shared Gadgets\german xxx girls glans shoes .mpeg.exe
    Filesize

    992KB

    MD5

    b292bf150e6c02d7416c3dd71d1a1103

    SHA1

    4478767781de395fbbe07f3096909bb980b65864

    SHA256

    05db6be7c2f986c673752ab921774fc15bac14164294f331893071e7c7361c8b

    SHA512

    2c4bef5ccc226555d3d4121378adc1c86133f2146ab927c34054b3897cf226c582c944d2d508db15f9cb837605749eccebf5c36206b7b5c88920651874e6e6d5

    Download Submit

  • C:\debug.txt
    Filesize

    183B

    MD5

    04632f2281832face4b8dea6cec1cf48

    SHA1

    93d06d87d6dcff83ffdccb11df81331c4ab2ff91

    SHA256

    2467d05e662905e132ca1d7b521df70fdf9d742fe3fcd83e2cc05db5fabfd679

    SHA512

    15a1a4e881877dc6a04312adbd4e97604db0c8c0e7ef1c2f569ae63ea0d6faf30ebd6ae2680506c9e351d3a17a5861eabd5ef5f5986dff26356fd5157fd433fc

    Download Submit

  • memory/2368-61-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2368-97-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2480-15-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2480-94-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2892-0-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2892-14-0x0000000004A50000-0x0000000004A6E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2892-60-0x0000000004A60000-0x0000000004A7E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2892-91-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2892-93-0x0000000004A50000-0x0000000004A6E000-memory.dmp

    Filesize

    120KB

    Download