Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 13:16
Static task
static1
Behavioral task
behavioral1
Sample
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe
Resource
win10v2004-20240508-en
General
-
Target
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe
-
Size
16KB
-
MD5
839964e2c35a4d406b3873b074f605b2
-
SHA1
9f37abb1814ab082bb194c4f943239113d31f46b
-
SHA256
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4
-
SHA512
6abe4a1325e3170d0ebe26a1a439a85b12f4ccb38b105c8164c57c1b72914c38ee3009bae0170a067e1fe1eda1ab19890d53dc2933f749c3aecb73c6141d4963
-
SSDEEP
384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/E57:IMAQ+BzWPEwnE+KHM2/EJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 2552 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exesvhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winhost = "C:\\Windows\\svhost.exe" svhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exesvhost.exedescription ioc process File created C:\Windows\svhost.exe 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe File created C:\Windows\svhost.exe svhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exesvhost.exedescription pid process Token: SeDebugPrivilege 2192 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe Token: SeDebugPrivilege 2552 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exedescription pid process target process PID 2192 wrote to memory of 2552 2192 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe svhost.exe PID 2192 wrote to memory of 2552 2192 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe svhost.exe PID 2192 wrote to memory of 2552 2192 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe svhost.exe PID 2192 wrote to memory of 2552 2192 3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe"C:\Users\Admin\AppData\Local\Temp\3f630b04253ce69c4760005a81a70bd852d8fadefa74ab07487cbd246e4031f4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3209222134\zmstage.exe.origFilesize
3.7MB
MD571cc69d724a032f664283fb630361418
SHA16711f1e04b972fdec3079696b1c13c9c577e25d9
SHA25684959598cd68bdad2e054f39b999b2229e4a0c15297635e4d0c9566e983b18f5
SHA5123e746423d4160e09ee8738ca396aea030374ffbdeaa25fc5ecc35918f49bfe4fb980d8e48559446c7787d5168dc37379a3480521f70febfc200e5b06f0bd22f5
-
C:\Users\Admin\AppData\Local\Temp\gEpXkmCCoOhboMQ.exeFilesize
16KB
MD5863f004decd338720aad3c2978e1adc1
SHA1088eb1f701e62f106d43e6c43728cb51884b0e68
SHA2567e1e85865681a399481036a0f6ba5827459f05f5eaf63f3097f8ac7090a0afaf
SHA51280629196bd7374f5c79bfb981893993e5dcf80a669596517b30223a88de5aca5fbf66b7430dad77a5de09beef7581e5fa24183c7a7f366095ce83d893eb45f85
-
C:\Windows\svhost.exeFilesize
16KB
MD576fd02b48297edb28940bdfa3fa1c48a
SHA1bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce
SHA25607abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c
SHA51228c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0