Analysis
-
max time kernel
89s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/05/2024, 18:45
General
-
Target
1.exe
-
Size
16.1MB
-
MD5
5a6fb976038ecc06c03a325d6cc2f229
-
SHA1
7fc052589af7cde03edd0cc4285c70740a6b0110
-
SHA256
a763ed959f9acbf036762256ba095c9a55de175cbc0844da572e6e01810bab32
-
SHA512
9e144eb83001818b31300c9c9deacf14edae989800b35af6bc937d622e2bbf20d17f80bc747ee05a5a2f43d1d8f0ec8244660c072adb0fd4969b7dbbc7351b8f
-
SSDEEP
393216:Id07D6k3meWcGfd9YMBaw2pGW8O8nEnO:Idm6ag5F9YC2IW8Ob
Malware Config
Signatures
-
Loads dropped DLL 45 IoCs
pid Process 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe 4776 1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3040 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4776 3928 1.exe 80 PID 3928 wrote to memory of 4776 3928 1.exe 80 PID 4776 wrote to memory of 1944 4776 1.exe 81 PID 4776 wrote to memory of 1944 4776 1.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:1944
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4628
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\yandex_pass.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5ff2c1c4a7ae46c12eb3963f508dad30f
SHA14d759c143f78a4fe1576238587230acdf68d9c8c
SHA25673cf4155df136db24c2240e8db0c76bedcbb721e910558512d6008adaf7eed50
SHA512453ef9eed028ae172d4b76b25279ad56f59291be19eb918de40db703ec31cddf60dce2e40003dfd1ea20ec37e03df9ef049f0a004486cc23db8c5a6b6a860e7b
-
Filesize
13KB
MD5fe489576d8950611c13e6cd1d682bc3d
SHA12411d99230ef47d9e2e10e97bdea9c08a74f19af
SHA256bb79a502eca26d3418b49a47050fb4015fdb24bee97ce56cdd070d0fceb96ccd
SHA5120f605a1331624d3e99cfdc04b60948308e834aa784c5b7169986eefbce4791faa148325c1f1a09624c1a1340e0e8cf82647780ffe7b3e201fdc2b60bcfd05e09
-
Filesize
14KB
MD5a33ac93007ab673cb2780074d30f03bd
SHA1b79fcf833634e6802a92359d38fbdcf6d49d42b0
SHA2564452cf380a07919b87f39bc60768bcc4187b6910b24869dbd066f2149e04de47
SHA5125d8bdca2432cdc5a76a3115af938cc76cf1f376b070a7fd1bcbf58a7848d4f56604c5c14036012027c33cc45f71d5430b5abbfbb2d4adaf5c115ddbd1603ab86
-
Filesize
10KB
MD5821aaa9a74b4ccb1f75bd38b13b76566
SHA1907c8ee16f3a0c6e44df120460a7c675eb36f1dd
SHA256614b4f9a02d0191c3994205ac2c58571c0af9b71853be47fcf3cb3f9bc1d7f54
SHA5129d2ef8f1a2d3a7374ff0cdb38d4a93b06d1db4219bae06d57a075ee3dff5f7d6f890084dd51a972ac7572008f73fde7f5152ce5844d1a19569e5a9a439c4532b
-
Filesize
12KB
MD5619fb21dbeaf66bf7d1b61f6eb94b8c5
SHA17dd87080b4ed0cba070bb039d1bdeb0a07769047
SHA256a2afe994f8f2e847951e40485299e88718235fbefb17fccca7ace54cc6444c46
SHA512ee3dbd00d6529fcfcd623227973ea248ac93f9095430b9dc4e3257b6dc002b614d7ce4f3daab3e02ef675502afdbe28862c14e30632e3c715c434440615c4dd4
-
Filesize
14KB
MD5cea18eb87e54403af3f92f8d6dbdd6e8
SHA1f1901a397edd9c4901801e8533c5350c7a3a8513
SHA2567fe364add28266c8211457896d2517fdb0ee9efc8cb65e716847965b3e9d789f
SHA51274a3c94d8c4070b66258a5b847d9ced705f81673dd12316604e392c9d21ae6890e3720ca810b38e140650397c6ff05fd2fa0ff2d136fc5579570520ffdc1dbac
-
Filesize
17KB
MD55e6fef0ff0c688db13ed2777849e8e87
SHA13e739107b1b5ff8f1ffaac2ede75b71d4ebd128f
SHA256e88a0347f9969991756815dff0af940f00e966bc7875aa4763a2c80516f7e4ed
SHA512b97d4aa0ae76f528e643180ed300f1a50eafe8b82c27212a95ce380bca85f9ce1ff1ac1190173d56776fd663f649817514d6501ce80518f526159398daa6f55c
-
Filesize
21KB
MD56abdcd64face45efb50a3f2d6d792b93
SHA1038dbd53932c4a539c69db54707b56e4779f0eef
SHA2561031ea4c1fd2f673089052986629b6f554e5b34582b2f38e134fd64876d9ce0f
SHA5126ebe3572938734d0fa9e4ec5abdb7f63d17f28ba7e94f1fe40926be93668d1a542ffc963f9a49c5f020720caad0852579fed6c9c6d0ab71b682e27245adc916c
-
Filesize
10KB
MD53af448b8a7ef86d459d86f88a983eaec
SHA1d852be273fea71d955ea6b6ed7e73fc192fb5491
SHA256bf3a209eda07338762b8b58c74965e75f1f0c03d3f389b0103cc2bf13acfe69a
SHA512be8c0a9b1f14d73e1adf50368293eff04ad34bda71dbf0b776ffd45b6ba58a2fa66089bb23728a5077ab630e68bf4d08af2712c1d3fb7d79733eb06f2d0f6dbf
-
Filesize
2.5MB
MD540161f97be89efba847554e36b226698
SHA165c8499a802f21a3b716ffdabd5b0e40548f5195
SHA25669bee07eb107f9daad969a16e1497f210b5d30a1a8ddd5c7bd8a5467bbcdee85
SHA5127bd182e249fac4ff0fa84b5750144b6434cc2027a6d78a801decdd292de7143eb3175490d116e9b344f4ababcdbae824fe833bff7a768bf9033c01efa7c72856
-
Filesize
106KB
MD549c96cecda5c6c660a107d378fdfc3d4
SHA100149b7a66723e3f0310f139489fe172f818ca8e
SHA25669320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
-
Filesize
48KB
MD5cf0a1c4776ffe23ada5e570fc36e39fe
SHA12050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA2566fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
SHA512d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
-
Filesize
82KB
MD54438affaaa0ca1df5b9b1cdaa0115ec1
SHA14eda79eaf3de614d5f744aa9eea5bfcf66e2d386
SHA256ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
SHA5126992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6
-
Filesize
120KB
MD56114277c6fc040f68d25ca90e25924cd
SHA1028179c77cb3ba29cd8494049421eaa4900ccd0e
SHA256f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
SHA51276e8ebefb9ba4ea8dcab8fce50629946af4f2b3f2f43163f75483cfb0a97968478c8aaef1d6a37be85bfc4c91a859deda6da21d3e753daefe084a203d839353d
-
Filesize
63KB
MD51524882af71247adecf5815a4e55366a
SHA1e25014c793c53503bdff9af046140edda329d01b
SHA2566f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
SHA5125b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a
-
Filesize
155KB
MD5737119a80303ef4eccaa998d500e7640
SHA1328c67c6c4d297ac13da725bf24467d8b5e982e3
SHA2567158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
SHA5121c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c
-
Filesize
31KB
MD58bbed19359892f8c95c802c6ad7598e9
SHA1773fca164965241f63170e7a1f3a8fa17f73ea18
SHA2564e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
SHA51222ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0
-
Filesize
77KB
MD564a6c475f59e5c57b3f4dd935f429f09
SHA1ca2e0719dc32f22163ae0e7b53b2caadb0b9d023
SHA256d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
SHA512cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973
-
Filesize
117KB
MD5a7df575bf69570944b004dfe150e8caf
SHA12fd19be98a07347d59afd78c167601479aac94bb
SHA256b1223420e475348c0bfb90fae33fc44ce35d988270294158ec366893df221a4b
SHA51218c381a4ded8d33271cbf0bea75af1c86c6d34cc436f68fb9342951c071c10d84cf9f96a0509c53e5886d47fed5bca113a7f7863f6873583daa7bb6af1aa9afa
-
Filesize
172KB
MD5a0b40f1f8fc6656c5637eacacf7021f6
SHA138813e25ffde1eee0b8154fa34af635186a243c1
SHA25679d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
SHA512c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713
-
Filesize
1.8MB
MD51df66a5a8d8c7bc333ed59a827e131e3
SHA1614986f57b9922cedf4df5ebadaa10ea307d46d1
SHA256190afb1aa885c2aa3516ab343e35f6b10472f4314492c8c4492c7d0f2add2f80
SHA5126568af0d41b1d2f1d4a75e25705777ec263c4a903db164923f4a10118218270a2b003f16f39ae238fe71f0dc1ad52d0cc1ac93a7bf2c6643d009f825dd00e1aa
-
Filesize
10KB
MD528af0ffb49cc20fe5af9fe8efa49d6f1
SHA12c17057c33382ddffea3ca589018cba04c4e49d7
SHA256f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0
SHA5129aa99e17f20a5dd485ae43ac85842bd5270ebab83a49e896975a8fa9f98ffc5f7585bef84ed46ba55f40a25e224f2640e85cebe5acb9087cf46d178ecc8029f0
-
Filesize
110KB
MD56cdca2fde9df198da58955397033af98
SHA1e457c97721504d25f43b549d57e4538a62623168
SHA256a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7
SHA5127b3c384ba9993d3192ed852191ff77bdcd3421cbc69ff636c6deb8fe7248e066573b68d80a8f280ae0c1cb015f79967d46d910455d932eaeac072c76d0757e92
-
Filesize
4.9MB
MD57a6a8c2a8c379b111cdceb66b18d687d
SHA1f3b8a4c731fa0145f224112f91f046fddf642794
SHA2568e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
SHA512f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
771KB
MD564acb046fe68d64ee475e19f67253a3c
SHA1d9e66c9437ce6f775189d6fdbd171635193ec4cc
SHA256b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
SHA512f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766
-
Filesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081
-
Filesize
131KB
MD590b786dc6795d8ad0870e290349b5b52
SHA1592c54e67cf5d2d884339e7a8d7a21e003e6482f
SHA25689f2a5c6be1e70b3d895318fdd618506b8c0e9a63b6a1a4055dff4abdc89f18a
SHA512c6e1dbf25d260c723a26c88ec027d40d47f5e28fc9eb2dbc72a88813a1d05c7f75616b31836b68b87df45c65eef6f3eaed2a9f9767f9e2f12c45f672c2116e72
-
Filesize
29KB
MD5653bdccb7af2aa9ccf50cb050fd3be64
SHA1afe0a85425ae911694c250ab4cb1f6c3d3f2cc69
SHA256e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
SHA51207e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277
-
Filesize
1.4MB
MD5b49b8fde59ee4e8178c4d02404d06ee7
SHA11816fc83155d01351e191d583c68e722928cce40
SHA2561afd7f650596ad97fcf358b0e077121111641c38ca9d53132bab4c9588cf262f
SHA512a033ce87c2e503b386fb92aa79a7ec14d6c96e4a35d0cb76d4989bacd16f44c4ed5ac4e13057f05f9d199a3fd8545b9a25296515ec456f29c464d949ff34942a
-
Filesize
1.1MB
MD51905b5d0f945499441e8cd58eb123d86
SHA1117e584e6fcc0e8cfc8e24e3af527999f14bac30
SHA256b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
SHA512ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522
-
Filesize
121KB
MD55390ade0ed5428024f3d854b5b9bfe9f
SHA1dada7b44887dcb7b77dcadb9690baecf3ee2b937
SHA2569771f09be29bd7a69abe774e28472a392382883c18a3cc524f8141e84b1be22c
SHA51292e82eff79f45d4de1cf27946a357f122c5337a85315d7c139458a1a6a51dffbf3cbfcf832851fbdcd0ec1bd0f82e7089125ffbbe3275675433089bddbff865b