Resubmissions
18-06-2024 09:06
240618-k2pt6a1bjq 10Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
18-06-2024 09:06
General
-
Target
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
-
Size
147KB
-
MD5
448f1796fe8de02194b21c0715e0a5f6
-
SHA1
935c0b39837319fda571aa800b67d997b79c3198
-
SHA256
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
-
SHA512
0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
-
SSDEEP
3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4
Malware Config
Extracted
C:\sYMY1N6ah.README.txt
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\39C6.tmp"C:\ProgramData\39C6.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\39C6.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD52ea1c97f79cb7350f2125e4a69620f82
SHA146b997ca6e009db16b44904cae894e1de0a95488
SHA256d29767d055e0a3868dcd0f7b0e18a3a33ae53cc2abcecd33ed013f138bf49d2c
SHA51231e36927a726adf9cab823aff205aee68f8aa598a94a61800cefc33fc11b2e4b05ebbcd53249a14ef40f6d40765dde60e387f8df7a0aa56a8ef3ec3ce640b673
-
Filesize
147KB
MD5604116890aec04ea7f4c85076576df9a
SHA14bae1a23eda76f289d9482f660a69ed33a02e21a
SHA256524c98e4d2f48a14048a6a139b4936e241e85d6e15b5c843e9addc2dc22c642e
SHA51228916e8525ebb49bd2fa13f35b12a9eca94fa59dab78405ed0f7efd263ca3688bce34d862764da58743e4776faffbc51618d8dca7fb1f68c3b745bf3bb63f149
-
Filesize
1KB
MD5deb2e0756d331362d57ad9fe408c4ff3
SHA1870865aad7c7cccafbca0c1f50f7eecaedbd4bf1
SHA2561ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c
SHA512e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6
-
Filesize
129B
MD5ff9f085c7c3db56b02ed6612aa2a8b83
SHA1b5c5ea77278c0e7e10bdba7291ae50ea7d002834
SHA2561287fc793a2402f3689890bd585f3576df520af824b1647dbdd06738184ed674
SHA512a90ecdcdbf995b4f3abf416fcb23b32f093dc878fff52aa3c3b212e198991c907c9ed3836186a7eb2a400888a2a422ad570f1234b2771230b093e795a1eaf6b6
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB