Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 10:16
Behavioral task
behavioral1
Sample
5aa49622f3dafc184f903b7b78a2fd68.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5aa49622f3dafc184f903b7b78a2fd68.exe
Resource
win10v2004-20240419-en
General
-
Target
5aa49622f3dafc184f903b7b78a2fd68.exe
-
Size
8.4MB
-
MD5
5aa49622f3dafc184f903b7b78a2fd68
-
SHA1
28fd3345d82da0cdb565a11c648aff196f03d770
-
SHA256
285493c54c35e3b571e28fc0816baa4b3833329eeec3649601dd6385a60c8d84
-
SHA512
fa7c3e619eb64355927fe4fe9ce925abba4c185b85816589a8e3bdf3ca7f0e73bb6c0ca939aa3699b29085f6d694eaf90f2224446156b80839d960a997b64d6d
-
SSDEEP
98304:YajcsQ5SggQZWfV1bihqdq7mXxUHp/nIaWl49u8cSu+A05TeKY7:cs3amByp/IpS9ASu+K
Malware Config
Extracted
stealc
http://193.163.7.82
-
url_path
/722c81812703a73d.php
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-1-0x0000000000400000-0x0000000000C87000-memory.dmp family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2576 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
ptInst.exeptInst.exepid process 2144 ptInst.exe 2664 ptInst.exe -
Loads dropped DLL 10 IoCs
Processes:
5aa49622f3dafc184f903b7b78a2fd68.exeptInst.exeptInst.exeexplorer.exepid process 1340 5aa49622f3dafc184f903b7b78a2fd68.exe 2144 ptInst.exe 2144 ptInst.exe 2144 ptInst.exe 2144 ptInst.exe 2664 ptInst.exe 2664 ptInst.exe 2664 ptInst.exe 2208 explorer.exe 2208 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ptInst.exedescription pid process target process PID 2664 set thread context of 2576 2664 ptInst.exe cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1596 timeout.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
5aa49622f3dafc184f903b7b78a2fd68.exeptInst.exeptInst.execmd.exeexplorer.exepid process 1340 5aa49622f3dafc184f903b7b78a2fd68.exe 1340 5aa49622f3dafc184f903b7b78a2fd68.exe 2144 ptInst.exe 2664 ptInst.exe 2664 ptInst.exe 2576 cmd.exe 2576 cmd.exe 2208 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ptInst.execmd.exepid process 2664 ptInst.exe 2576 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
5aa49622f3dafc184f903b7b78a2fd68.exepid process 1340 5aa49622f3dafc184f903b7b78a2fd68.exe 1340 5aa49622f3dafc184f903b7b78a2fd68.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
5aa49622f3dafc184f903b7b78a2fd68.exepid process 1340 5aa49622f3dafc184f903b7b78a2fd68.exe 1340 5aa49622f3dafc184f903b7b78a2fd68.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
5aa49622f3dafc184f903b7b78a2fd68.exeptInst.exeptInst.execmd.exeexplorer.execmd.exedescription pid process target process PID 1340 wrote to memory of 2144 1340 5aa49622f3dafc184f903b7b78a2fd68.exe ptInst.exe PID 1340 wrote to memory of 2144 1340 5aa49622f3dafc184f903b7b78a2fd68.exe ptInst.exe PID 1340 wrote to memory of 2144 1340 5aa49622f3dafc184f903b7b78a2fd68.exe ptInst.exe PID 1340 wrote to memory of 2144 1340 5aa49622f3dafc184f903b7b78a2fd68.exe ptInst.exe PID 2144 wrote to memory of 2664 2144 ptInst.exe ptInst.exe PID 2144 wrote to memory of 2664 2144 ptInst.exe ptInst.exe PID 2144 wrote to memory of 2664 2144 ptInst.exe ptInst.exe PID 2144 wrote to memory of 2664 2144 ptInst.exe ptInst.exe PID 2664 wrote to memory of 2576 2664 ptInst.exe cmd.exe PID 2664 wrote to memory of 2576 2664 ptInst.exe cmd.exe PID 2664 wrote to memory of 2576 2664 ptInst.exe cmd.exe PID 2664 wrote to memory of 2576 2664 ptInst.exe cmd.exe PID 2664 wrote to memory of 2576 2664 ptInst.exe cmd.exe PID 2576 wrote to memory of 2208 2576 cmd.exe explorer.exe PID 2576 wrote to memory of 2208 2576 cmd.exe explorer.exe PID 2576 wrote to memory of 2208 2576 cmd.exe explorer.exe PID 2576 wrote to memory of 2208 2576 cmd.exe explorer.exe PID 2576 wrote to memory of 2208 2576 cmd.exe explorer.exe PID 2208 wrote to memory of 2776 2208 explorer.exe cmd.exe PID 2208 wrote to memory of 2776 2208 explorer.exe cmd.exe PID 2208 wrote to memory of 2776 2208 explorer.exe cmd.exe PID 2208 wrote to memory of 2776 2208 explorer.exe cmd.exe PID 2776 wrote to memory of 1596 2776 cmd.exe timeout.exe PID 2776 wrote to memory of 1596 2776 cmd.exe timeout.exe PID 2776 wrote to memory of 1596 2776 cmd.exe timeout.exe PID 2776 wrote to memory of 1596 2776 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5aa49622f3dafc184f903b7b78a2fd68.exe"C:\Users\Admin\AppData\Local\Temp\5aa49622f3dafc184f903b7b78a2fd68.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\supernotepad_x86\ptInst.exeC:\Users\Admin\AppData\Local\Temp\supernotepad_x86\ptInst.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\supernotepad_x86\ptInst.exeC:\Users\Admin\AppData\Roaming\supernotepad_x86\ptInst.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe4⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "" & del "C:\ProgramData\*.dll"" & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 57⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\90b969beFilesize
863KB
MD59f6ba036ffc8665e27c64119fb9fba3b
SHA19b1b9450fbb755a0d3c75fd4c93e8abdd7d0ee3b
SHA256848f64b1c4c39e494410acf46cda990b4fdfc582d713575c8734b546658542e5
SHA5120a1c39cfe952f345158e220c0680838d65a3b064806723b966a7baa5ec6a07f79d2c4fd8851bf4c19aa9549f6fd5d2a46d64418f774b67ae2fc1652d360d5ec5
-
C:\Users\Admin\AppData\Local\Temp\supernotepad_x86\MSVCP140.dllFilesize
427KB
MD571a0aa2d05e9174cefd568347bd9c70f
SHA1cb9247a0fa59e47f72df7d1752424b33a903bbb2
SHA256fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47
SHA5126e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a
-
C:\Users\Admin\AppData\Local\Temp\supernotepad_x86\VCRUNTIME140.dllFilesize
81KB
MD516b26bc43943531d7d7e379632ed4e63
SHA1565287de39649e59e653a3612478c2186096d70a
SHA256346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
SHA512b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
-
C:\Users\Admin\AppData\Local\Temp\supernotepad_x86\WCLDll.dllFilesize
590KB
MD5ff7cf8ca0936fb896cb3cad4ef58562b
SHA14772f1a6e8445f375ca26969702ae3b3d63d9e2b
SHA2563155a2327a00e2c9c5d9da09973cbf05aae4ffec1cc3f0f2f0b58a4eb6b2f55e
SHA512fd993601f208a8475b0d4538b96790e31d6131da9682a912d99211ac55d4e22486ee65506ed9a5ab3ccb7e4a5fff6133982836abeda15a119ea7eaaaef86f3ad
-
C:\Users\Admin\AppData\Local\Temp\supernotepad_x86\autunite.vcfFilesize
19KB
MD58240c2b1b55106bce4b205de628ca628
SHA1202d7f1d9c2756a195411f29bedc06d574088c8f
SHA25637702dbbd99aea78164d61af4d577764bb0ea358edb1fa097f40e9a9c5039d82
SHA5125a1204170fed5c46572f9b41626d66225a18f701642b3b804f1005800af43d4f00388530a0a121381d42fd3f68f4e479e978c339ec11b241b2be1b1aafe6209a
-
C:\Users\Admin\AppData\Local\Temp\supernotepad_x86\truancy.mp3Filesize
621KB
MD56d7397b107945d59f070f46dfeb0114f
SHA156f8f27680953eb87e6301d860c066f3699a2492
SHA25677b4ac6b13188c9c69717b2199ca9e844e0c32e15a61c538c6908d05994eeade
SHA512073349e96484315696fdb4fe26aa2c932a3eb18030253d1ac804201a41b2f9bc2c088994e7a09407b902a3f02e230cbab28669753a027bc4cb2ce28298cc75a6
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\supernotepad_x86\ptInst.exeFilesize
938KB
MD5b15bac961f62448c872e1dc6d3931016
SHA11dcb61babb08fe5db711e379cb67335357a5db82
SHA256bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
SHA512932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
-
memory/1340-18-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/1340-3-0x0000000077B40000-0x0000000077CE9000-memory.dmpFilesize
1.7MB
-
memory/1340-17-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/1340-12-0x0000000074C72000-0x0000000074C74000-memory.dmpFilesize
8KB
-
memory/1340-5-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/1340-1-0x0000000000400000-0x0000000000C87000-memory.dmpFilesize
8.5MB
-
memory/1340-2-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/1340-0-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1340-55-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/2144-31-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/2144-32-0x0000000077B40000-0x0000000077CE9000-memory.dmpFilesize
1.7MB
-
memory/2208-65-0x0000000077B40000-0x0000000077CE9000-memory.dmpFilesize
1.7MB
-
memory/2208-64-0x0000000000400000-0x000000000063D000-memory.dmpFilesize
2.2MB
-
memory/2208-66-0x0000000000400000-0x000000000063D000-memory.dmpFilesize
2.2MB
-
memory/2208-68-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/2208-119-0x0000000000400000-0x000000000063D000-memory.dmpFilesize
2.2MB
-
memory/2576-61-0x0000000077B40000-0x0000000077CE9000-memory.dmpFilesize
1.7MB
-
memory/2576-62-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/2664-59-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/2664-52-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/2664-54-0x0000000074C60000-0x0000000074DD4000-memory.dmpFilesize
1.5MB
-
memory/2664-53-0x0000000077B40000-0x0000000077CE9000-memory.dmpFilesize
1.7MB