Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 21:41
Behavioral task
behavioral1
Sample
Dupe_EXTERNAL.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dupe_EXTERNAL.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
cstealer.pyc
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
cstealer.pyc
Resource
win10v2004-20240226-en
General
-
Target
cstealer.pyc
-
Size
39KB
-
MD5
859d53b651327931b647406b22a76e60
-
SHA1
128ed3b3f2d4ff3e3ce4562b4d6dd19e01008414
-
SHA256
c069a156ac0ad7c0fddb43a28fcc7cf8b09b07c0ce1fb6de8648e399e206debb
-
SHA512
b6b8fe39a3bc66dc10c8c56b12a47ee5b2e46241d80004cc928dc983a8ae9dd1fa855eb16cae061fec9fac425b3c01039269b40710d8d1e206b0782ba5649140
-
SSDEEP
768:fuAF/lvck17WnMGF+5JsylM3jprKBBbxoZUM4PqVfqrY9Wygqxie3HrKl4HYiBe/:x/ukW0JsyC3F6OUM6qVirY9WygWiMujf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2600 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2600 AcroRd32.exe 2600 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2084 wrote to memory of 2676 2084 cmd.exe rundll32.exe PID 2084 wrote to memory of 2676 2084 cmd.exe rundll32.exe PID 2084 wrote to memory of 2676 2084 cmd.exe rundll32.exe PID 2676 wrote to memory of 2600 2676 rundll32.exe AcroRd32.exe PID 2676 wrote to memory of 2600 2676 rundll32.exe AcroRd32.exe PID 2676 wrote to memory of 2600 2676 rundll32.exe AcroRd32.exe PID 2676 wrote to memory of 2600 2676 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cstealer.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cstealer.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD53a41ca2be38befc6eb0470acd4351d73
SHA178b5c0fec489e8a24c9e947c3a699c95195a7614
SHA2561de4740501abbca411a6bef7eceeba81c3080ab46e9bcdd379d25e9731e0d624
SHA51256347ad55bc3cd6df603b3ac42883c58a0ef94a3c304cbc9160f827b999ab860e3f457b15aa53226a4e13d31ded27095e445aefbf41ac13e30d547574f2949c0