Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 00:56

General

  • Target

    Oplata ponedel'nik.exe

  • Size

    1.1MB

  • MD5

    9a4c7ae4bcaa653ffd966d17785ed92d

  • SHA1

    610343dbeb9e63ddd7fa2cfb765c8dda3c37c150

  • SHA256

    d06be7bd36b4cdd6ac12e3c7fb675515cd33ae9ea75a26e7dc7fc3a7db14caff

  • SHA512

    e6da37f1da3c075f0d435592eb69ef9cbfeb94f96f450b1a560fc7f9e7b6a5b903fdefa4fd2a749dfa0e3c5d0eac2777428e7dc92af0543cbc6ea55d3bf5d51f

  • SSDEEP

    3072:jBMY6A1ztHItWsT3i9/bW/Yx00yuhUb+SIT5DWqKlYcrgx+ICPKGy3yLs3/BJ:jB5JHIl6au00yrqSIZWDlujT

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe
    "C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe
      "C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe" dfsr
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c ping 127.0.0.1 & del /F /Q "C:\Users\Admin\AppData\Local\Temp\Oplata ponedel'nik.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:3948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1564-2-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1564-0-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/1564-1-0x00000000006F0000-0x00000000006FE000-memory.dmp

    Filesize

    56KB

  • memory/4948-3-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4948-7-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB

  • memory/4948-9-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4948-11-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4948-10-0x0000000000400000-0x0000000000524000-memory.dmp

    Filesize

    1.1MB