Overview

overview

7

Static

static

3

b997ef62dc...a9.exe

windows7-x64

7

b997ef62dc...a9.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    91s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 07:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b997ef62dc25778d77cfb3ceb56227c01f2d4933e24c258ce4d52367b2eb0ea9.exe
  • Size 6.6MB
  • Sample240609-jhpvdage29
  • SHA256 b997ef62dc25778d77cfb3ceb56227c01f2d4933e24c258ce4d52367b2eb0ea9
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b997ef62dc25778d77cfb3ceb56227c01f2d4933e24c258ce4d52367b2eb0ea9.exe
    "C:\Users\Admin\AppData\Local\Temp\b997ef62dc25778d77cfb3ceb56227c01f2d4933e24c258ce4d52367b2eb0ea9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Users\Admin\AppData\Local\Temp\b997ef62dc25778d77cfb3ceb56227c01f2d4933e24c258ce4d52367b2eb0ea9.exe
      "C:\Users\Admin\AppData\Local\Temp\b997ef62dc25778d77cfb3ceb56227c01f2d4933e24c258ce4d52367b2eb0ea9.exe"
      2⤵
      • Loads dropped DLL
      PID:4020

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\VCRUNTIME140.dll
        • Size 91KB
        • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_bz2.pyd
        • Size 84KB
        • SHA256 6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_ctypes.pyd
        • Size 123KB
        • SHA256 c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_hashlib.pyd
        • Size 64KB
        • SHA256 8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_lzma.pyd
        • Size 158KB
        • SHA256 ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_socket.pyd
        • Size 78KB
        • SHA256 09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\_ssl.pyd
        • Size 150KB
        • SHA256 2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\base_library.zip
        • Size 768KB
        • SHA256 3bb960a9c9fcfcf9643b992b39903d47f45599ed84c6bb76bc532f5191f3fb0a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        homo.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\homo.exe.manifest
        • Size 1KB
        • SHA256 848bb5302f691697f0e04cecfa707dd44f8013eb7d0fa6f39723ecddf8e6e44c
        • MD5 SHA1 SHA512
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libcrypto-1_1.dll
        • Size 2.1MB
        • SHA256 04cf95f0f0b76a6766427245f702e46616f083addd3d2f383a863a1c708218c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libcrypto-1_1.dll
        • Size 2.0MB
        • SHA256 286da065e4d043b4f6d6b26402b426498486ad4e5b932c586a9c3f2b01a6a2af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\libssl-1_1.dll
        • Size 673KB
        • SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\python39.dll
        • Size 1.9MB
        • SHA256 699c6d74e2fceedd2f9c2372ecfa505c712f78f9946a0e89a0c9ceef1d8443f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\python39.dll
        • Size 2.1MB
        • SHA256 d9e893a1fe0c0393b9cb044f1d010f792a8714aa6a824c86257db1d977c50f52
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\select.pyd
        • Size 27KB
        • SHA256 b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI47002\unicodedata.pyd
        • Size 1.1MB
        • SHA256 9be2b4c7db2c3a05ec3cbd08970e622fcaeb4091a55878df12995f2aeb727e72
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download