Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe
Resource
win7-20240611-en
General
-
Target
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe
-
Size
1.2MB
-
MD5
ca8e6c01282b57405ae4b2af66adbafa
-
SHA1
dab881b117a4e3515ff9315e30ce1a0a814ad42d
-
SHA256
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c
-
SHA512
e8bffdcd21fa92b902b2b3b0e1dee8ce38b2c9956758acd217b1b89a085d435bac293a7d11cacd043855fcb999c8d302af42ad8d340af748834013c1875a6da4
-
SSDEEP
24576:CAHnh+eWsN3skA4RV1Hom2KXMmHa7cldzvKO1X3JWCRYj3m25:Fh+ZkldoPK8Ya7yd+Od3BRUj
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
name.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid process 3112 name.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\directory\name.exe autoit_exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
name.exesvchost.exerundll32.exedescription pid process target process PID 3112 set thread context of 808 3112 name.exe svchost.exe PID 808 set thread context of 3384 808 svchost.exe Explorer.EXE PID 808 set thread context of 1012 808 svchost.exe rundll32.exe PID 1012 set thread context of 3384 1012 rundll32.exe Explorer.EXE PID 1012 set thread context of 2668 1012 rundll32.exe Firefox.exe -
Processes:
rundll32.exedescription ioc process Key created \Registry\User\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
svchost.exerundll32.exepid process 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 808 svchost.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
name.exesvchost.exerundll32.exepid process 3112 name.exe 808 svchost.exe 808 svchost.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe 1012 rundll32.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exename.exeExplorer.EXEpid process 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 3112 name.exe 3112 name.exe 3384 Explorer.EXE 3384 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exename.exepid process 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe 3112 name.exe 3112 name.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3384 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exename.exesvchost.exerundll32.exedescription pid process target process PID 4520 wrote to memory of 3112 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 4520 wrote to memory of 3112 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 4520 wrote to memory of 3112 4520 e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe name.exe PID 3112 wrote to memory of 808 3112 name.exe svchost.exe PID 3112 wrote to memory of 808 3112 name.exe svchost.exe PID 3112 wrote to memory of 808 3112 name.exe svchost.exe PID 3112 wrote to memory of 808 3112 name.exe svchost.exe PID 808 wrote to memory of 1012 808 svchost.exe rundll32.exe PID 808 wrote to memory of 1012 808 svchost.exe rundll32.exe PID 808 wrote to memory of 1012 808 svchost.exe rundll32.exe PID 1012 wrote to memory of 2668 1012 rundll32.exe Firefox.exe PID 1012 wrote to memory of 2668 1012 rundll32.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"5⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"6⤵PID:2668
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD52456358082381cfbd59c47ddaa58edec
SHA1498b677a53f41f660f095ef549280dc23a43b680
SHA256f9e93076b397c10d887645865170f0fb0a0dd4fcaae025d62563412430d82f93
SHA512a3767b7c724e1b8abc3bc1e525eb89d6523205e96fb3e8c244cc6ef6cf2594d929860df25d2bb7277713be9a6846282c1527b68f81ac74c32acd4e5162e6a6df
-
Filesize
265KB
MD5da0227fbe8330d1408a4d3faa465be0a
SHA1ee14a891e166d16850b4883311ee05584735165a
SHA2565a388efe7461b3845cbd5f9ff89f97937fbdf08edf226646d27421d393ee9825
SHA512365240a84c7935bf4021d494261a0a7511a1f5da98a54a5eabad77f3ce06c3a8bd8d3bf43c10ae90a53f1cf1604d2cfcb6892da3443187e0af02eb86d968bf01
-
Filesize
1.2MB
MD5ca8e6c01282b57405ae4b2af66adbafa
SHA1dab881b117a4e3515ff9315e30ce1a0a814ad42d
SHA256e1dc04d5611806a578a793ef0d188c49858c004a291529e1818585e57993396c
SHA512e8bffdcd21fa92b902b2b3b0e1dee8ce38b2c9956758acd217b1b89a085d435bac293a7d11cacd043855fcb999c8d302af42ad8d340af748834013c1875a6da4