Overview

overview

8

Static

static

3

353725b611...42.exe

windows7-x64

8

353725b611...42.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 18:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe
  • Size 63KB
  • Sample240609-xam8gaec79
  • SHA256 353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
spywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe
        "C:\Users\Admin\AppData\Local\Temp\353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1056
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:3112
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE426.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:384
            • C:\Users\Admin\AppData\Local\Temp\353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe
              "C:\Users\Admin\AppData\Local\Temp\353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe"
              4⤵
              • Executes dropped EXE
              PID:1500
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops file in Drivers directory
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5068
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3852
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2912
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2532
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2364
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4136,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
            1⤵
              PID:232

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  GoogleUpdateCore.exe
                  • Path C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
                  • Size 258KB
                  • SHA256 7fa5727c71a47da122856c4af832bd40f9f9b04393ee2fecb82b5031ba0852e5
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  7z.exe
                  • Path C:\Program Files\7-Zip\7z.exe
                  • Size 577KB
                  • SHA256 4b2e66cc5fc849819829a4f3f97234c18d47b5b2902af2789e4c92de8d0b7cce
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  windowsdesktop-runtime-8.0.2-win-x64.exe
                  • Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
                  • Size 644KB
                  • SHA256 636c1c024e59354f13d9bb02fa8f3849112c4557ab790a37146b1c121e597b24
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  $$aE426.bat
                  • Path C:\Users\Admin\AppData\Local\Temp\$$aE426.bat
                  • Size 722B
                  • SHA256 dbcbf7e73e553367df0903c2ac636001cabcaaa28b737161b235eff50166ee0c
                  • MD5 SHA1 SHA512
                  Submit Download

                  353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\353725b611d669d7d5592d731e394d87dcc1e70de2a95a1c56cb89c2f0eccd42.exe.exe
                  • Size 29KB
                  • SHA256 7c32fe8ec1851e273763a2742a67a1f9c09a3725c9eaec76e22fcfc92dda7c88
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  Logo1_.exe
                  • Path C:\Windows\Logo1_.exe
                  • Size 33KB
                  • SHA256 0f613830d4414afd617e8e2d765db67ba765ce6d6e97f11b564be43e87ae82a5
                  • MD5 SHA1 SHA512 SSDEEP
                  Submit Download

                  hosts
                  • Path C:\Windows\system32\drivers\etc\hosts
                  • Size 842B
                  • SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
                  • MD5 SHA1 SHA512
                  Submit Download

                  _desktop.ini
                  • Path F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\_desktop.ini
                  • Size 8B
                  • SHA256 551cc5b618f0fa78108dd2388d9136893adb10499e4836e9728f4e96530bf02f
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/2452-0-0x0000000000400000-0x000000000043E000-memory.dmp
                  Download

                  memory/2452-10-0x0000000000400000-0x000000000043E000-memory.dmp
                  Download

                  memory/5068-20-0x0000000000400000-0x000000000043E000-memory.dmp
                  Download

                  memory/5068-11-0x0000000000400000-0x000000000043E000-memory.dmp
                  Download

                  memory/5068-5256-0x0000000000400000-0x000000000043E000-memory.dmp
                  Download

                  memory/5068-9044-0x0000000000400000-0x000000000043E000-memory.dmp
                  Download