Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 18:06
Behavioral task
behavioral1
Sample
Celex_V2.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Celex_V2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
cstealer.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
cstealer.pyc
Resource
win10v2004-20240508-en
General
-
Target
cstealer.pyc
-
Size
39KB
-
MD5
859d53b651327931b647406b22a76e60
-
SHA1
128ed3b3f2d4ff3e3ce4562b4d6dd19e01008414
-
SHA256
c069a156ac0ad7c0fddb43a28fcc7cf8b09b07c0ce1fb6de8648e399e206debb
-
SHA512
b6b8fe39a3bc66dc10c8c56b12a47ee5b2e46241d80004cc928dc983a8ae9dd1fa855eb16cae061fec9fac425b3c01039269b40710d8d1e206b0782ba5649140
-
SSDEEP
768:fuAF/lvck17WnMGF+5JsylM3jprKBBbxoZUM4PqVfqrY9Wygqxie3HrKl4HYiBe/:x/ukW0JsyC3F6OUM6qVirY9WygWiMujf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2264 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2264 AcroRd32.exe 2264 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1284 wrote to memory of 2616 1284 cmd.exe rundll32.exe PID 1284 wrote to memory of 2616 1284 cmd.exe rundll32.exe PID 1284 wrote to memory of 2616 1284 cmd.exe rundll32.exe PID 2616 wrote to memory of 2264 2616 rundll32.exe AcroRd32.exe PID 2616 wrote to memory of 2264 2616 rundll32.exe AcroRd32.exe PID 2616 wrote to memory of 2264 2616 rundll32.exe AcroRd32.exe PID 2616 wrote to memory of 2264 2616 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cstealer.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cstealer.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cstealer.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5b1a321a2cca071a63f35eb4d1cb80e88
SHA1f1985921fce6411a741d3570faa736b45797abdd
SHA2563cd9a85cb61511b6a5ccce992c3339f397a41db3ded940bc83257d133ea9a276
SHA5127b5bb2ce64b105c58c7d6cc87e75bf1fbafe1e881a6e449334bbe3f2cb573c063dc356c6f598c7dc86de86c661ec2dfed5f75c8b3f8192086312f6cd9f4bc2ae