Overview

overview

10

Static

static

10

913ad33937...42.exe

windows7-x64

9

913ad33937...42.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 23:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe

  • Size

    471KB

  • MD5

    d973614d4cac301358263701ff674963

  • SHA1

    9126bdac6de090d1f4d9c1cde85daa933345eb45

  • SHA256

    913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42

  • SHA512

    4129b75063ca45c6f8c4153c6ca92f556dfd3d860510b63aa80a3704b9d97e4aaa5b118eca1a24f03126848ec7fd713af0a81183cd348ac8e6fc3f951a0e21b8

  • SSDEEP

    12288:JXCNi9BVcvXy6sPPyo45dZqNwlG7MEYTUso9nWp489+:sWCvkPPyX58w6M6sQnWp489+

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 60 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
    "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
      "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
      2⤵
      • Checks computer location settings
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
        "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
        3⤵
        • Checks computer location settings
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:396
        • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
          "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
          4⤵
          • Checks computer location settings
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4904
          • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
            "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:3648
            • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
              "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
              6⤵
                PID:3336
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 1284
              5⤵
              • Program crash
              PID:3276
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1348
            4⤵
            • Program crash
            PID:5068
        • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
          "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
          3⤵
          • Checks computer location settings
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:5076
          • C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe
            "C:\Users\Admin\AppData\Local\Temp\913ad33937f9cb469cbde4cf092d777cf829be7b1fe2c9fc767807dd800d5c42.exe"
            4⤵
              PID:4588
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 1356
              4⤵
              • Program crash
              PID:1472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1356
            3⤵
            • Program crash
            PID:2920
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 1320
          2⤵
          • Program crash
          PID:1048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2632 -ip 2632
        1⤵
          PID:2368
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4648 -ip 4648
          1⤵
            PID:540
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 396 -ip 396
            1⤵
              PID:1524
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4904 -ip 4904
              1⤵
                PID:3772
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5076 -ip 5076
                1⤵
                  PID:1688

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lesbian catfight (Samantha).mpg.exe
                  Filesize

                  1.6MB

                  MD5

                  5a8b65a3d38469518b4b88499a91b081

                  SHA1

                  77ca3175ef8abe78c820d42d42ade5d436492808

                  SHA256

                  12d2617014204934496b681b190a6817053811c9b94193b86462a74e0028d15c

                  SHA512

                  9eb9bd90a7d5a3045d892d68e349de4f0502228df650047f970347e5aab86541a1ef8932e3a759a88f0986356063957650fa5304fa73fbb30c8086cdce8c0078

                  Download Submit

                • C:\debug.txt
                  Filesize

                  216B

                  MD5

                  1cbd75998aaa2d7a7534d254a0b34bdf

                  SHA1

                  e7abd6acc7a7fd1f631eab1811e3c8dac0fb1f52

                  SHA256

                  4a9cde893d71f07fc072618d15f17ac2c7c82e1f16451fc3541f73a7abd86c19

                  SHA512

                  b1f55661598539e6dd81bd576ccf008f3d28d591c5fece1299a71b37d08d21ed0127055dd333989f8d2fd81fad4ffdddfe0f4131bacb86df13492d47d7925bc4

                  Download Submit

                • C:\debug.txt
                  Filesize

                  364B

                  MD5

                  b133ccfc3a5ecdd30b0e56374f3d6c3d

                  SHA1

                  9f3fa36e60b28b086818c791d58ec580dd0aaff0

                  SHA256

                  4662f7d40fdeb91707e004737c91f49d87b7083dfa9fef40954b8b5d00b7570e

                  SHA512

                  58a089fe34dd933dea381bd400d351bfd8cf8ed25820f1f1405f6464be94f12ee36fc4b896cec48f5d31a39ee6f143fc2337bfd4b27f2c56bb076dfdd71ae0f8

                  Download Submit

                • C:\debug.txt
                  Filesize

                  488B

                  MD5

                  f2b0259b187a5729eb788c1cc4b6f22e

                  SHA1

                  da36bfc2b3525f5becb6ede6f081bc3cb24c16fb

                  SHA256

                  41a24fa96606eb823e0974deeb9435ddb7f9e39045b3300d481fd9e26228824c

                  SHA512

                  b0cf022dee46299930be94f7b46e06ffe81859231592cf407ae6ad252ab5f08179f6792f419882a2304b619bc8298ea13138ca76a4e36ce2be2646a55e6c650d

                  Download Submit

                • C:\debug.txt
                  Filesize

                  599B

                  MD5

                  161945b479668cbb22f515f407e5be99

                  SHA1

                  f710ba65f53bbdc702186ce8b0c7370e2166e774

                  SHA256

                  db0217acc2fb6eb6a491517cc1dd82ecf1dde102d2fc05a7c4c6f9ee40190f6e

                  SHA512

                  4c64c79961b686ce5b87cc4b20b8da70f9ae5825c39019ff903868f8ac3242f173c0eb3186f47d61743fb5848558639793d481414c43a2b1fc0a61998f8e71a5

                  Download Submit

                • C:\debug.txt
                  Filesize

                  710B

                  MD5

                  a0c654fb7f38299172d42cc3647b024f

                  SHA1

                  f391f786206ca2dcaf63f92ce1d9e815ff257ed7

                  SHA256

                  007868044e400b0c560bd2e993010f27c175f1fcb861c42ebbd455b949c02064

                  SHA512

                  17ab2c38e4454eb9ffffea3650dd55b007d44d79703631c3f7fc9ab13d59a135230a2a5b37cfb3c10ad4c03c75f48752ebe7e74ac17041d6387a6d81e245629c

                  Download Submit