Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
26-06-2024 02:28
General
-
Target
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
-
Size
147KB
-
MD5
448f1796fe8de02194b21c0715e0a5f6
-
SHA1
935c0b39837319fda571aa800b67d997b79c3198
-
SHA256
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
-
SHA512
0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
-
SSDEEP
3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4
Malware Config
Extracted
C:\sYMY1N6ah.README.txt
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\2607.tmp"C:\ProgramData\2607.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2607.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ad34584fc638002e376062efa7571e7f
SHA182ed20255292609e915605d5735350744ad4a7d3
SHA2563c5e120a559da0828d7d479e16e0c61d3f066e25918408e8c90a06149dbdfbea
SHA51276b83c8dd21bfe1a0212cb1a6b4724d2e27b164cad7cba8f5977d382975527bb2c11cefe77b325fe2281b16f0fb581be6ef4ce8ec48046059fd2798b35a54e1d
-
Filesize
147KB
MD5d407a3bc7861072f878cb845e75fa00e
SHA1ec64d3ba71e47a5d6df17275b706892d47cb4d5d
SHA25688958bb38d624fdae15882eda59f30eddfa83deee5483c70c78c86baed87ada4
SHA512c0e268871c75238153b15082c4f7a64b9a24c3765af8db6b63ae259841d4bc94495c92b023de9b870e6910095cae6b5976a97c2b94e45e68325e73aeac35775c
-
Filesize
1KB
MD5deb2e0756d331362d57ad9fe408c4ff3
SHA1870865aad7c7cccafbca0c1f50f7eecaedbd4bf1
SHA2561ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c
SHA512e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6
-
Filesize
129B
MD5f7f167bbb2eeca5aae378cbe17ffe736
SHA1ef6076f3b52dcd869b4ef5b2cee99ec129205cbf
SHA256603a8bc5915329ae851a733aad5c3273bd5ecb7607dc71541d1171a7e0eab540
SHA512bb80c75388e458bff58492c51a7a64af9a99b1ee6f98374087ee5dea2642bd7b9a3509730e4d2fe2568668576bb24c0c68bd8a1ebdd259d0242e5ec708ccfbd7
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB