Analysis
- max time kernel
149s - max time network
87s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/06/2024, 22:53
General
- Target TudouVa.exe
- Size 3.1MB
- Sample240612-2t4f1stfmg
- SHA256 df21244436967f84445da37d6d4dd61d71f22a4f95eb6041c29a0dc1d1740963
Malware Config
Signatures
- Drops startup file 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 15 IoCs
- Suspicious use of SendNotifyMessage 15 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TudouVa.exe"C:\Users\Admin\AppData\Local\Temp\TudouVa.exe"1⤵
- Drops startup file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tudouva.ini
tudouva.ini
memory/1448-12-0x0000000003F20000-0x0000000004038000-memory.dmp
memory/1448-13-0x0000000004060000-0x000000000408F000-memory.dmp
memory/1448-15-0x0000000004060000-0x0000000004093000-memory.dmp
memory/1448-19-0x0000000004060000-0x00000000040AE000-memory.dmp
memory/1448-17-0x0000000004060000-0x000000000409F000-memory.dmp
memory/1448-21-0x0000000004100000-0x000000000412F000-memory.dmp
memory/1448-45-0x0000000060900000-0x0000000060953000-memory.dmp