Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 16:26
Static task
static1
Behavioral task
behavioral1
Sample
66F26F04628F10BA6A66A759977F01F9.exe
Resource
win7-20240221-en
General
-
Target
66F26F04628F10BA6A66A759977F01F9.exe
-
Size
19.3MB
-
MD5
66f26f04628f10ba6a66a759977f01f9
-
SHA1
b78d1c56fcda9a1bb8b0b6ecaf4d406960048922
-
SHA256
aabc266802f04d1eeea56deddf0bc38f4e14d5c67685fd9c4a7c6d98efa7b31d
-
SHA512
0c5bc4b933a7e5dff076e81020ec78b512fb05fb217a49d1469445c2e77d57dfb9280ac6d439f84499ec3c4450cf369bfcf219e7f4d9389fbd39e66d6afee25d
-
SSDEEP
49152:BD95ju4gEp9ywkJa3REQPN69LcLPigAFLhRlqagBM9UOZmX/TQjE:BD9FgE6VJaBEQ9rigAF1qaEkUCmk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
wininit.exepid process 2500 wininit.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ipinfo.io 12 ipinfo.io 13 ipinfo.io 4 ipinfo.io -
Drops file in System32 directory 2 IoCs
Processes:
66F26F04628F10BA6A66A759977F01F9.exedescription ioc process File created C:\Windows\System32\Printing_Admin_Scripts\de-DE\66F26F04628F10BA6A66A759977F01F9.exe 66F26F04628F10BA6A66A759977F01F9.exe File created C:\Windows\System32\Printing_Admin_Scripts\de-DE\95a77ee6b4922f 66F26F04628F10BA6A66A759977F01F9.exe -
Drops file in Program Files directory 2 IoCs
Processes:
66F26F04628F10BA6A66A759977F01F9.exedescription ioc process File created C:\Program Files (x86)\Common Files\Adobe\Updater6\winlogon.exe 66F26F04628F10BA6A66A759977F01F9.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\cc11b995f2a76d 66F26F04628F10BA6A66A759977F01F9.exe -
Drops file in Windows directory 4 IoCs
Processes:
66F26F04628F10BA6A66A759977F01F9.exedescription ioc process File created C:\Windows\PLA\Templates\taskhost.exe 66F26F04628F10BA6A66A759977F01F9.exe File opened for modification C:\Windows\PLA\Templates\taskhost.exe 66F26F04628F10BA6A66A759977F01F9.exe File created C:\Windows\PLA\Templates\b75386f1303e64 66F26F04628F10BA6A66A759977F01F9.exe File created C:\Windows\diagnostics\wininit.exe 66F26F04628F10BA6A66A759977F01F9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
66F26F04628F10BA6A66A759977F01F9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 66F26F04628F10BA6A66A759977F01F9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 66F26F04628F10BA6A66A759977F01F9.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
66F26F04628F10BA6A66A759977F01F9.exepid process 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe 2208 66F26F04628F10BA6A66A759977F01F9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
wininit.exepid process 2500 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
66F26F04628F10BA6A66A759977F01F9.exewininit.exedescription pid process Token: SeDebugPrivilege 2208 66F26F04628F10BA6A66A759977F01F9.exe Token: SeDebugPrivilege 2500 wininit.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
66F26F04628F10BA6A66A759977F01F9.execmd.exedescription pid process target process PID 2208 wrote to memory of 520 2208 66F26F04628F10BA6A66A759977F01F9.exe cmd.exe PID 2208 wrote to memory of 520 2208 66F26F04628F10BA6A66A759977F01F9.exe cmd.exe PID 2208 wrote to memory of 520 2208 66F26F04628F10BA6A66A759977F01F9.exe cmd.exe PID 520 wrote to memory of 760 520 cmd.exe chcp.com PID 520 wrote to memory of 760 520 cmd.exe chcp.com PID 520 wrote to memory of 760 520 cmd.exe chcp.com PID 520 wrote to memory of 1288 520 cmd.exe PING.EXE PID 520 wrote to memory of 1288 520 cmd.exe PING.EXE PID 520 wrote to memory of 1288 520 cmd.exe PING.EXE PID 520 wrote to memory of 2500 520 cmd.exe wininit.exe PID 520 wrote to memory of 2500 520 cmd.exe wininit.exe PID 520 wrote to memory of 2500 520 cmd.exe wininit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66F26F04628F10BA6A66A759977F01F9.exe"C:\Users\Admin\AppData\Local\Temp\66F26F04628F10BA6A66A759977F01F9.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XqNmX3it8n.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- Runs ping.exe
-
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe"C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\winlogon.exeFilesize
19.3MB
MD566f26f04628f10ba6a66a759977f01f9
SHA1b78d1c56fcda9a1bb8b0b6ecaf4d406960048922
SHA256aabc266802f04d1eeea56deddf0bc38f4e14d5c67685fd9c4a7c6d98efa7b31d
SHA5120c5bc4b933a7e5dff076e81020ec78b512fb05fb217a49d1469445c2e77d57dfb9280ac6d439f84499ec3c4450cf369bfcf219e7f4d9389fbd39e66d6afee25d
-
C:\Users\Admin\AppData\Local\Temp\XqNmX3it8n.batFilesize
202B
MD51fcef95a83b34cd405dc69a3b235c5ec
SHA1a9df00797e8bc12c1b5bcf43c5168df7d7dc78d5
SHA256347668124de421dc929f87dc66c07a7167252ede8540bd073a3cd8223d16ebae
SHA5125cc9f8a8679e598fcd9782620ff92bf7e12bd7aa39203b83a98fababe8eb87e3adea0cb269b1dd88c287d6301c5c90194f10e589b18ee98f059c405865ccecda
-
memory/2208-35-0x0000000002260000-0x0000000002270000-memory.dmpFilesize
64KB
-
memory/2208-6-0x00000000021E0000-0x0000000002206000-memory.dmpFilesize
152KB
-
memory/2208-4-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-38-0x00000000025C0000-0x00000000025D6000-memory.dmpFilesize
88KB
-
memory/2208-7-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-9-0x0000000000200000-0x000000000020E000-memory.dmpFilesize
56KB
-
memory/2208-10-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-12-0x0000000000430000-0x000000000044C000-memory.dmpFilesize
112KB
-
memory/2208-14-0x0000000000410000-0x0000000000420000-memory.dmpFilesize
64KB
-
memory/2208-15-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-16-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-18-0x0000000002230000-0x0000000002248000-memory.dmpFilesize
96KB
-
memory/2208-20-0x0000000000420000-0x0000000000430000-memory.dmpFilesize
64KB
-
memory/2208-22-0x00000000005D0000-0x00000000005E0000-memory.dmpFilesize
64KB
-
memory/2208-24-0x0000000000A10000-0x0000000000A1E000-memory.dmpFilesize
56KB
-
memory/2208-36-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-31-0x0000000002250000-0x000000000225E000-memory.dmpFilesize
56KB
-
memory/2208-27-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-33-0x00000000025A0000-0x00000000025B2000-memory.dmpFilesize
72KB
-
memory/2208-26-0x0000000002210000-0x000000000221E000-memory.dmpFilesize
56KB
-
memory/2208-83-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-3-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-29-0x0000000002220000-0x000000000222C000-memory.dmpFilesize
48KB
-
memory/2208-40-0x000000001AA60000-0x000000001AA72000-memory.dmpFilesize
72KB
-
memory/2208-42-0x0000000002270000-0x000000000227E000-memory.dmpFilesize
56KB
-
memory/2208-44-0x0000000002280000-0x000000000228C000-memory.dmpFilesize
48KB
-
memory/2208-46-0x000000001AA80000-0x000000001AA90000-memory.dmpFilesize
64KB
-
memory/2208-48-0x000000001AA90000-0x000000001AAA0000-memory.dmpFilesize
64KB
-
memory/2208-50-0x000000001AEE0000-0x000000001AF3A000-memory.dmpFilesize
360KB
-
memory/2208-52-0x000000001AAA0000-0x000000001AAAE000-memory.dmpFilesize
56KB
-
memory/2208-54-0x000000001AE80000-0x000000001AE90000-memory.dmpFilesize
64KB
-
memory/2208-56-0x000000001AE90000-0x000000001AE9E000-memory.dmpFilesize
56KB
-
memory/2208-58-0x000000001AEA0000-0x000000001AEA8000-memory.dmpFilesize
32KB
-
memory/2208-60-0x000000001AF40000-0x000000001AF58000-memory.dmpFilesize
96KB
-
memory/2208-62-0x000000001AEB0000-0x000000001AEBC000-memory.dmpFilesize
48KB
-
memory/2208-64-0x000000001B4D0000-0x000000001B51E000-memory.dmpFilesize
312KB
-
memory/2208-2-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-75-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-76-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmpFilesize
4KB
-
memory/2208-77-0x000007FEF58A0000-0x000007FEF628C000-memory.dmpFilesize
9.9MB
-
memory/2208-1-0x0000000000A20000-0x0000000000DD8000-memory.dmpFilesize
3.7MB
-
memory/2208-0-0x000007FEF58A3000-0x000007FEF58A4000-memory.dmpFilesize
4KB
-
memory/2500-86-0x00000000013B0000-0x0000000001768000-memory.dmpFilesize
3.7MB