dba996def529089215989ab14a108333e0412a73d6968323bf5df81262cf800c

Analysis

max time kernel
17s
max time network
48s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Firefox Installer.exe
Size

341KB
MD5

ef43e8c737e3cc08a327104520d9f79e
SHA1

aa5f400f82a045b733555790d39b1a252ead7158
SHA256

dba996def529089215989ab14a108333e0412a73d6968323bf5df81262cf800c
SHA512

58dcc2293e79437eefba2ff85f937a30f563164239cb0b8353d4953e5fb442906cd7f18f71e0508e44d0f1d5ba01612c9e35cbd2e0f0bc292759dd71879fa406
SSDEEP

6144:vaVWdyzOxeA1DfdwX3MmIOH7sarBE/QEWgUY6RBacP4UB8SnuZEFiYuJL:vMROxdDfOnMmXbsarBEoE34lpBIEFinR

Score

7^/10

spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/5036-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral1/memory/5036-78-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

Processes:

setup-stub.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\nse4410.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nse4412.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nse4413.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nse4412.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nse4410.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nse4411.tmp	setup-stub.exe

Executes dropped EXE 1 IoCs

Processes:

setup-stub.exe

pid process

4848 setup-stub.exe
Loads dropped DLL 7 IoCs

Processes:

setup-stub.exe

pid process

4848 setup-stub.exe
4848 setup-stub.exe
4848 setup-stub.exe
4848 setup-stub.exe
4848 setup-stub.exe
4848 setup-stub.exe
4848 setup-stub.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3448 4848 WerFault.exe setup-stub.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

setup-stub.exe

pid process

4848 setup-stub.exe
4848 setup-stub.exe

pid	process
4848	setup-stub.exe

pid	process
4848	setup-stub.exe
4848	setup-stub.exe
4848	setup-stub.exe
4848	setup-stub.exe
4848	setup-stub.exe
4848	setup-stub.exe
4848	setup-stub.exe

pid	pid_target	process	target process
3448	4848	WerFault.exe	setup-stub.exe

pid	process
4848	setup-stub.exe
4848	setup-stub.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Firefox Installer.exe

description	pid	process	target process
PID 5036 wrote to memory of 4848	5036	Firefox Installer.exe	setup-stub.exe
PID 5036 wrote to memory of 4848	5036	Firefox Installer.exe	setup-stub.exe
PID 5036 wrote to memory of 4848	5036	Firefox Installer.exe	setup-stub.exe

C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Temp\7zSCA376907\setup-stub.exe
.\setup-stub.exe
2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 2520
3⤵
- Program crash
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4848 -ip 4848
1⤵
PID:2992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSCA376907\setup-stub.exe
Filesize
551KB

MD5
01a63d3b2fb99552bc82885f9c81439e

SHA1
1a4edfd9fbef36ae9692677c66aa9d2b8b6e8c97

SHA256
51c80c14f8b7d1b0f39d2365a3ab3727044c61afd71eafa3ec3e6879f1766cb3

SHA512
4afacfc9ff5b504197431a9277e613c11eebd2d77e24260db258f5b7a1eb0f717fb3844b921913226706e3bf73f40d4005ac9ade91cbbe45ddae2fa6f9174773

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\CityHash.dll
Filesize
53KB

MD5
2021acc65fa998daa98131e20c4605be

SHA1
2e8407cfe3b1a9d839ea391cfc423e8df8d8a390

SHA256
c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14

SHA512
cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\InetBgDL.dll
Filesize
17KB

MD5
97c607f5d0add72295f8d0f27b448037

SHA1
dfb9a1aa1d3b1f7821152afaac149cad38c8ce3c

SHA256
dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5

SHA512
ad759062152869089558389c741876029198c5b98fa725e2d2927866dc8b416ae2de871cb2479f614f6d29b6f646bf7191d02837c3cabc15b8185b563bc46268

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\System.dll
Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\UAC.dll
Filesize
28KB

MD5
d23b256e9c12fe37d984bae5017c5f8c

SHA1
fd698b58a563816b2260bbc50d7f864b33523121

SHA256
ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

SHA512
13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\UserInfo.dll
Filesize
14KB

MD5
610ad03dec634768cd91c7ed79672d67

SHA1
dc8099d476e2b324c09db95059ec5fd3febe1e1e

SHA256
c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df

SHA512
18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\WebBrowser.dll
Filesize
103KB

MD5
b53cd4ad8562a11f3f7c7890a09df27a

SHA1
db66b94670d47c7ee436c2a5481110ed4f013a48

SHA256
281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec

SHA512
bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\profile_cleanup.html
Filesize
1KB

MD5
1cb97b5f8c5f2728b26742d1d0669899

SHA1
bb5ab1b8c00810fcb18184a996573c5accdc72c3

SHA256
dec82e9caa154300e1aa44f550c16b455a2025be4fb1c3155cb75fe04a6b6611

SHA512
768ed2b070485f3bbcf457aefdc0ef8f1737ad8ac4a2703e2feaff424f9a2c69a2f5928a3be898932ef4976a44ea829a099d090bd9941a24d045d5c8ac8b7b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\profile_cleanup.js
Filesize
1KB

MD5
d845e8f4c0edb3cab17e6a30090ac5b8

SHA1
654f058570f0868f0acc5f0595147f3385a9c265

SHA256
1adcfdd9768242c6c639b10e4f0bcda24f6a957a169c1dede265e40336ecbd4f

SHA512
401d800c484b74401b90c3285d8b6cc0018baf4979d6ec7bb174f7810d3f60adfa6b4cebeafcee20d5a7c3597447f755af19c5fecf1863e2438fe427dbdf9fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy43EF.tmp\stub_common.js
Filesize
815B

MD5
efce3dce0165b3f6551db47e5c0ac8d6

SHA1
1e15f6bb688e3d645092c1aa5ee3136f8de65312

SHA256
dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e

SHA512
cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988

Download Submit
memory/5036-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5036-78-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download