Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-06-2024 08:15
General
-
Target
6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe
-
Size
147KB
-
MD5
9c5698924d4d1881efaf88651a304cb3
-
SHA1
c60a0b99729eb6d95c2d9f8b76b9714411a3a751
-
SHA256
6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417
-
SHA512
1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea
-
SSDEEP
3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p
Malware Config
Extracted
C:\flzQgniJJ.README.txt
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe"C:\Users\Admin\AppData\Local\Temp\6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\2674.tmp"C:\ProgramData\2674.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2674.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5279d6ce9bd056a66df0bbc9621fb5551
SHA175cc1b9b7ab0f565cfc3070078981a78cce77df1
SHA25645890a9ef6c825e5e3048bfebc02921a793bd2b1bb09f02e6f102a26170f2530
SHA512a8c089743320ee2507e2a9d71f4eb19a10b8d494d241516d28a1ceb97c6d0afeacbe379512aa0fb01f7d0047ee27d85c7ee40c2162bae7e2e154b84bbf8ec9fa
-
Filesize
147KB
MD525ee540455aa6e7c2a62dd2b031338a9
SHA13cb32879f4c7ebd5d6f0d6a8bb9784382e953a6a
SHA256fe2ee862b95abf378b011b78a48e04c1734df7bd6152c98376271b83e66a84e0
SHA512be06066eca9cba4720496e16634591bfc31e4ba14f6147b283d3cfb776342e46230bb92f61d2fb8c99e3930cd1835e2b6f526a73d26b235beef178b0f72d868e
-
Filesize
1KB
MD53bebb5494e1c3d4753ce92a479e7eda5
SHA1243685d0515d19210e4e2f354d367be6212e98ff
SHA25613d69c85aeb5beab58caefaa2cdc257d668f568103a5cebbd98038b3b66b66bd
SHA5120e31e7bf96fbd6bb91fbe96e59acf96dd0fef5e9db9e93e924afd17fe1066c04b0d9bf9e2d60c335db4f0347107a63d92dfc9ba9b166d2e3151e5440232f63da
-
Filesize
129B
MD5909ccf477533aab846be71b943c87f39
SHA12e01477cefc43a17f22927ae1c4d5250eb5110e5
SHA256197a98bb20b549f41fbe2794853ec18a2a999b777593c8c9e4171ac657745703
SHA512ae13384ab0e5d1f1860243963646f53af74138cea7bff404f9e9ea22b19674b2d04657a682c6a2300d7aa7426f3d0189cb2721495a2e90c182b9e3c8cbb37317
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB