Analysis
-
max time kernel
64s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
26-06-2024 05:55
General
-
Target
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe
-
Size
147KB
-
MD5
448f1796fe8de02194b21c0715e0a5f6
-
SHA1
935c0b39837319fda571aa800b67d997b79c3198
-
SHA256
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
-
SHA512
0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
-
SSDEEP
3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4
Malware Config
Extracted
C:\sYMY1N6ah.README.txt
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"C:\Users\Admin\AppData\Local\Temp\eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\43D4.tmp"C:\ProgramData\43D4.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\43D4.tmp >> NUL3⤵
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD566cc200e948b31bd477708b8173b2ec8
SHA17a8df217945ee0beec7fc59383ee7de5e245fd72
SHA256ce9fb1a99cf8e4434f752994e9a62081e6f3e9591cbdbb03ef25e04a19638a2a
SHA512c3a3ed3d9ed8c7a1acaa852105cd399f82a3163451b097f984bb92a701769f4456ce4f9c40108583ef5fe55981922d593fa4ba8bb7392ea0a3004f8576f2a0ea
-
Filesize
147KB
MD5493063b0d5b78ca18876d42d9ac9040a
SHA1ef9cc1eb40536ed671b50950e24f74fb7db5282d
SHA256cc59351c71f688e2b5d20745cf38cea72045ae57137766cae7cb6e531626bf56
SHA512e93ca09eaae60ee456d1d49d12dba9701c95e4b6b765fbe6c495bbf914dd4f3ee14d72237cbf0140d1772acf41f48d18514e26ee1858799c78e595890a4ff8b8
-
Filesize
1KB
MD5deb2e0756d331362d57ad9fe408c4ff3
SHA1870865aad7c7cccafbca0c1f50f7eecaedbd4bf1
SHA2561ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c
SHA512e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6
-
Filesize
129B
MD5a5c9ff0fffc133cfd39e331cc36ffd45
SHA11cf2daa09d4d015ee2b15b3cfbd96d0c7c9e7e66
SHA256cfb6f4053bd71a54f599c2cd91ff0f842a6575c9690d0e6c11716d072c608f28
SHA512296273e4fa99dd9452ab6038f69db8ad6829484b43d7471b20b4abf0c8357021cd31d1ba4c69333ccc4c4c2573b671709cb45ee2655d7d648e5fd41af144b054
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB