Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 20:46
Behavioral task
behavioral1
Sample
fa854b73b477f55bd2faa482ba8e8fc4.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
fa854b73b477f55bd2faa482ba8e8fc4.exe
Resource
win10v2004-20240419-en
General
-
Target
fa854b73b477f55bd2faa482ba8e8fc4.exe
-
Size
1.3MB
-
MD5
fa854b73b477f55bd2faa482ba8e8fc4
-
SHA1
056fb1cdf016ac6d510425ae4dc1693f257dc12e
-
SHA256
905c7a4a098ad5c0fae3b8f15fa5fa56a06372b7441aede1958ae1171e555b2a
-
SHA512
fe1b5c9c6a709b34687e35745bd7662aaff0bf816aedb4f59a68714c4797034e1472c667611eb10fb687916e899613fbb79d692a11cc5e074fce5a2ba1ee54c5
-
SSDEEP
24576:ZtnIMSJmXTYznHLtEqzH+qrjQYgkIuIcDH7IueXN5CUaCWyOVyOckiAhUcMkiAhl:ZtIMvE7rtz7+q/QYgkIu3DHkuedz6rVl
Malware Config
Extracted
stealc
http://193.163.7.82
-
url_path
/722c81812703a73d.php
Signatures
-
Detects HijackLoader (aka IDAT Loader) 1 IoCs
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000055A000-memory.dmp family_hijackloader -
HijackLoader
HijackLoader is a multistage loader first seen in 2023.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1928 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 2580 explorer.exe 2580 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 1928 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 28 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 1928 cmd.exe 1928 cmd.exe 2580 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 1928 cmd.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1928 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 28 PID 1732 wrote to memory of 1928 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 28 PID 1732 wrote to memory of 1928 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 28 PID 1732 wrote to memory of 1928 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 28 PID 1732 wrote to memory of 1928 1732 fa854b73b477f55bd2faa482ba8e8fc4.exe 28 PID 1928 wrote to memory of 2580 1928 cmd.exe 30 PID 1928 wrote to memory of 2580 1928 cmd.exe 30 PID 1928 wrote to memory of 2580 1928 cmd.exe 30 PID 1928 wrote to memory of 2580 1928 cmd.exe 30 PID 1928 wrote to memory of 2580 1928 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa854b73b477f55bd2faa482ba8e8fc4.exe"C:\Users\Admin\AppData\Local\Temp\fa854b73b477f55bd2faa482ba8e8fc4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
MD5441e099c5a4a8225526874cc17958d6d
SHA19fad26a37d978dfef0951d113bb5f68fa5088b48
SHA256fd417bbac268c9da5b15aa7c27d8ccf5b151c86b491e731c22aa4b5cfda1ae78
SHA512d3fa98bf0b4c587837187a49901b40a0056f09d02e3e73c66f33c3f46d90ca18408059aa89ad230f352eb6d3903e17b25824cf05acfa58864a82c600cd480969
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571