Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 07:26
Behavioral task
behavioral1
Sample
33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe
-
Size
6.3MB
-
MD5
b17775b6663b665ac1acf8f7913a7885
-
SHA1
b6200eae22ecbf474d38562327fa72db4e22f96a
-
SHA256
33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329
-
SHA512
0350d1cd6f61f367cc2adccb05e5d3b557550174692d0f8f309446326d5f1a8767ddbb1d689cafb8bfb5a553fb4d95979c6d56a9016497ead5e5f962a4963dd2
-
SSDEEP
196608:LKS2Vqqp+/UurGTGcej5wU7420mSZH5IC2ZDcUN:Pojp+9aTGcelwU7bUeC2KG
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2016 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2272 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Loads dropped DLL 2 IoCs
pid Process 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1964-0-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral1/memory/1964-2-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral1/memory/1964-20-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral1/files/0x002c000000015ccd-22.dat upx behavioral1/memory/2272-31-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral1/memory/2272-32-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral1/memory/1964-44-0x0000000000400000-0x0000000001352000-memory.dmp upx behavioral1/memory/2272-53-0x0000000000400000-0x0000000001352000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1044 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe Token: SeDebugPrivilege 2272 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 2272 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 2272 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 2272 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 2272 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2272 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 30 PID 1964 wrote to memory of 2272 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 30 PID 1964 wrote to memory of 2272 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 30 PID 1964 wrote to memory of 2272 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 30 PID 1964 wrote to memory of 2016 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 31 PID 1964 wrote to memory of 2016 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 31 PID 1964 wrote to memory of 2016 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 31 PID 1964 wrote to memory of 2016 1964 33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe 31 PID 2016 wrote to memory of 1044 2016 cmd.exe 33 PID 2016 wrote to memory of 1044 2016 cmd.exe 33 PID 2016 wrote to memory of 1044 2016 cmd.exe 33 PID 2016 wrote to memory of 1044 2016 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe"C:\Users\Admin\AppData\Local\Temp\33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exeC:\Users\Admin\33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 2 &del "C:\Users\Admin\AppData\Local\Temp\33c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:1044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792B
MD5fc16485c7eac3319d2a65d594e0f6ce5
SHA1a7b35eb9b5f4d02ec5db74cd19cd42c6acb980a3
SHA256e1fd40138c66bea68c449664125186a59774f9d7fa67a5f2b8c99c5106ab7e1c
SHA512c683b2e9d8c282b2b143c6562c72e57bb13223c1bede3fea33afdad4007808df4fa61b09eee4a586631139f1c92970a89948ba5149bcea932a30585b7e82115c
-
Filesize
6.3MB
MD5b17775b6663b665ac1acf8f7913a7885
SHA1b6200eae22ecbf474d38562327fa72db4e22f96a
SHA25633c243cc58c63fb435f65266eb92be129c4bd39a14794ee506fa8724cb62c329
SHA5120350d1cd6f61f367cc2adccb05e5d3b557550174692d0f8f309446326d5f1a8767ddbb1d689cafb8bfb5a553fb4d95979c6d56a9016497ead5e5f962a4963dd2