Analysis
- max time kernel
144s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
12/06/2024, 22:53
General
- Target TudouVa.exe
- Size 3.1MB
- Sample240612-2t4f1stfmg
- SHA256 df21244436967f84445da37d6d4dd61d71f22a4f95eb6041c29a0dc1d1740963
Malware Config
Signatures
- Drops startup file 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of FindShellTrayWindow 15 IoCs
- Suspicious use of SendNotifyMessage 15 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TudouVa.exe"C:\Users\Admin\AppData\Local\Temp\TudouVa.exe"1⤵
- Drops startup file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tudouva.ini
tudouva.ini
Æô¶¯·ÉËÙÍÁ¶¹.lnk
memory/2176-12-0x00000000033A0000-0x00000000034B8000-memory.dmp
memory/2176-13-0x00000000033A0000-0x00000000033CF000-memory.dmp
memory/2176-15-0x00000000033A0000-0x00000000033D3000-memory.dmp
memory/2176-17-0x00000000033A0000-0x00000000033DF000-memory.dmp
memory/2176-19-0x00000000033A0000-0x00000000033EE000-memory.dmp
memory/2176-21-0x0000000003E80000-0x0000000003EAF000-memory.dmp
memory/2176-45-0x0000000060900000-0x0000000060953000-memory.dmp