Overview

overview

10

Static

static

10

56b91b2f5c...c3.exe

windows7-x64

9

56b91b2f5c...c3.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 21:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe

  • Size

    740KB

  • MD5

    1d88522437dd253f814c0e38b43e59a9

  • SHA1

    3532dfbffe38f2040190e48ea50a12b92608b373

  • SHA256

    56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3

  • SHA512

    a90da2733864589913fd9b8c373cbad622b9c1e32c4934a55524b4f0aaffcf5d52db8e35213dd07727803d2eed810755cb1c1c8124dcd4e542a09a63a6462c44

  • SSDEEP

    12288:ZNzi9BdK1JQJ73VUbNgFfUKub5p3ziodPpXNmp+zlh+WxisDz6jkcGadiHhLBP7h:QdbJjVQOFsHL5pXNKFNcz6vWLBzlz

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe
    "C:\Users\Admin\AppData\Local\Temp\56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe
      "C:\Users\Admin\AppData\Local\Temp\56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Users\Admin\AppData\Local\Temp\56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe
        "C:\Users\Admin\AppData\Local\Temp\56b91b2f5cfbf42f2c692c14caec6995ca949fcd1b8b9c29e41a0c58d53ff8c3.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\bukkake kicking sleeping .mpeg.exe
    Filesize

    1.0MB

    MD5

    6b6a9a99a7d899ee5ca406dfa1274d7e

    SHA1

    9b195fcc925688e71ded11bd664b1ba104059b51

    SHA256

    c18ce14c016e96adf423191146e113435ab771f49bc28c7ec6d41ed0b7105980

    SHA512

    de1c965829803950ec9c0fe4072b52472e920a901ed08b9151f00d16153b7474ee59c79b276d0c5632c37b0e4dd0cf62bb760c7864b201898f2feed03ef8ecae

    Download Submit

  • C:\debug.txt
    Filesize

    183B

    MD5

    29cfe4fd7f3b3525971c254733bf4499

    SHA1

    e8f669728ddea8a97ffb480c7d4af647ec6ff823

    SHA256

    c2f310585bbd457b0f2556b49ebad3b84c7141e3ac5310347eec85f6f00ff294

    SHA512

    42cc4ac2157f1224a4fb2fe19d51a1ccc3984279f8be3fe61f13d4d543c10e0393875471403f9159a38e5954de3d9c45338d6949d3bd3de397fd03d32780f615

    Download Submit