Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:18
Behavioral task
behavioral1
Sample
cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe
Resource
win10v2004-20240508-en
General
-
Target
cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe
-
Size
17KB
-
MD5
09eca2becdc4276ce54d5589555bd0fa
-
SHA1
ff6b210d4bb51eb041057509120e8169ee53088d
-
SHA256
cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9
-
SHA512
afc3ac1a4916ed7af96119c63aa5bf61d2e27031118a5a379046ca2a0a4f4117c1b5ad286d50727dff74669be245f363fcdf1cd0948bca291e488cca30838c98
-
SSDEEP
384:tv+t/QgBssNSvNSV+EVeFuKk/RetkMHvLYYxHKpp7ppppph:t2h/EEQ0VKkJedYF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
videodrv.exepid process 468 videodrv.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1612-0-0x0000000000400000-0x0000000000479000-memory.dmp upx C:\Windows\videodrv.exe upx behavioral2/memory/1612-10-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-11-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-189-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-218-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-219-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-221-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-222-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-223-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral2/memory/468-224-0x0000000000400000-0x0000000000479000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exevideodrv.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\videodrv.exe" cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver = "C:\\Windows\\videodrv.exe" videodrv.exe -
Drops file in Windows directory 7 IoCs
Processes:
videodrv.execf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exedescription ioc process File created C:\Windows\videodrv.exe videodrv.exe File opened for modification C:\Windows\videodrv.exe videodrv.exe File opened for modification C:\Windows\exe.tmp videodrv.exe File opened for modification C:\Windows\zip.tmp videodrv.exe File opened for modification C:\Windows\eml.tmp videodrv.exe File created C:\Windows\videodrv.exe cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe File opened for modification C:\Windows\videodrv.exe cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exedescription pid process target process PID 1612 wrote to memory of 468 1612 cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe videodrv.exe PID 1612 wrote to memory of 468 1612 cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe videodrv.exe PID 1612 wrote to memory of 468 1612 cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe videodrv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe"C:\Users\Admin\AppData\Local\Temp\cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\videodrv.exeC:\Windows\videodrv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\eml.tmpFilesize
1KB
MD5ca33ce0459d86fc8a3a080423914fbcc
SHA17a463905bfb29d88b3832415f231d23bb954a465
SHA2569c4c9a4eb3df4ae8f0e6a6905b46333807a6a4c007846007b0784cbeb9e14bca
SHA512d1ff5c8e03f71e3cb42fa673a5932047769fc2c712dad110061cba672676128c39ecc7f3524f36ef68b66fc9ab818334e32a9810695583adab70d6ce156d5acc
-
C:\Windows\eml.tmpFilesize
658B
MD55dfb0c66013350c1968fad991e6ac5cc
SHA1f020b6acc2c54ecdca0398b81666c3478fed3bd8
SHA25683dbdcd1a4f1ceda3d9dfdfa55151cb9c541667d7b47df1477c492bb4c01b439
SHA5123f2659436ca8688515212529f7e3f9068a5640af32f2ed2b81be199934bd092a0548b3f34b751b1b9edfead8ed164e7d9722ca144102ded871651b20dc2967cc
-
C:\Windows\eml.tmpFilesize
1KB
MD53870fe8e12b12f8e406853dbc40f905f
SHA1df6b89f5ddfcadbada0a0088b2855bb15a104819
SHA256c9ba191397792a9fabc37b9162b8a73759c7e9c5ad77482ffe1a2af53ed8ce6c
SHA512453e8f0e55751e7e4bb942efb31331fe2b75761bc394033452fe67ad319b9943dc16a610c8bf97f2858a97ff099f97e9a32e408ee7770f635ac889f7c30e4a1d
-
C:\Windows\videodrv.exeFilesize
17KB
MD509eca2becdc4276ce54d5589555bd0fa
SHA1ff6b210d4bb51eb041057509120e8169ee53088d
SHA256cf2f0c8462f8d833a6e76ce03c622104a987295965d35635230eea6f313d57a9
SHA512afc3ac1a4916ed7af96119c63aa5bf61d2e27031118a5a379046ca2a0a4f4117c1b5ad286d50727dff74669be245f363fcdf1cd0948bca291e488cca30838c98
-
memory/468-11-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-189-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-218-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-219-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-221-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-222-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-223-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/468-224-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1612-0-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1612-10-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB