Overview

overview

10

Static

static

10

675658949f...96.exe

windows7-x64

9

675658949f...96.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 22:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe

  • Size

    2.0MB

  • MD5

    1b1711724b0cca40296e38e42ded08bc

  • SHA1

    0ab8c17f2a6e37547b1ab671ba98e05b62800a74

  • SHA256

    675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696

  • SHA512

    83b163b975025b5d0bb5d20b8d09ac4d1501001bf25e0d74af06524c4313b78ffd2dabb364bc6ff8b09a2ea5310a315ecd67831f31edff8654b9ba577d202dc2

  • SSDEEP

    49152:BE1jTpAQmoni+XurXVFV0TMMqov/xNOrTVIL:qjTeQmSXuXxGNO/VIL

Score
9/10
persistencespywarestealer

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 60 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
    "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
      "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
      2⤵
      • Checks computer location settings
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
        "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
        3⤵
        • Checks computer location settings
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
          "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
          4⤵
          • Checks computer location settings
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4984
          • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
            "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:1936
            • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
              "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
              6⤵
                PID:2024
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 1380
              5⤵
              • Program crash
              PID:4932
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1368
            4⤵
            • Program crash
            PID:2840
        • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
          "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
          3⤵
          • Checks computer location settings
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2496
          • C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe
            "C:\Users\Admin\AppData\Local\Temp\675658949f81fa6f8d20d4f9e0fe0492f7e77ff3d5f2b9b027c54db9ee1b1696.exe"
            4⤵
              PID:4252
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 1420
              4⤵
              • Program crash
              PID:3424
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1516
            3⤵
            • Program crash
            PID:776
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 1188
          2⤵
          • Program crash
          PID:2720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 672 -ip 672
        1⤵
          PID:3476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1484 -ip 1484
          1⤵
            PID:3652
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3036 -ip 3036
            1⤵
              PID:1944
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2496 -ip 2496
              1⤵
                PID:3016
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4984 -ip 4984
                1⤵
                  PID:812

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\japanese cumshot action [bangbus] ash bedroom (Anniston).mpeg.exe
                  Filesize

                  1.7MB

                  MD5

                  b088d2df720444f94fcae27d820e53be

                  SHA1

                  187111450187a0794af5e566036487cba1035967

                  SHA256

                  75ee4d5f4a80d6869351ae75a9fb4330e03cccc84fe67f95a7aad6e165bda08e

                  SHA512

                  6c463febfb46460850a432d93c71d138b13f7e784e956effa13b2dea11b2e7af159e5269750b02145a0e15bc7144d8b25e509492985d3ad94d1489db89982f8b

                  Download Submit

                • C:\debug.txt
                  Filesize

                  201B

                  MD5

                  b6123395d2c3f356e2323f1a04d38917

                  SHA1

                  2075061f23e686b7b25160e6d2a664fee2a446f6

                  SHA256

                  5973e9bac37c343bc8ab444a6498c91fced02e31de093ae5e5dd0f275d95abf3

                  SHA512

                  f163d102fb34a7e8efe60fbc3ba5b8048ace0dd8fa1ab9af7c3b8a238a2edd5830884924509e4f9eafc90bf1b1a1e1c25a0824013cf19e612a738b414fbc155a

                  Download Submit

                • C:\debug.txt
                  Filesize

                  312B

                  MD5

                  06ba44b2c4619672be7e72c3dab447fb

                  SHA1

                  e964759b70948ef5bd7e67e7ce82dc14b0f7a2b4

                  SHA256

                  8776baf3a519ed8cebc5048d0fbeaa5887e411af2112d6849b1e291ae2f83fa6

                  SHA512

                  1a906b622104a38b034287bfe98ad690f8981d61963c1009218732a746031fbcd16e2566e5f887a6a76fb5eff654664ceb26d8fbba1d1fb7d51c29f6c702c8d2

                  Download Submit

                • C:\debug.txt
                  Filesize

                  423B

                  MD5

                  0def964baba0c3fd560e4aebb7d1e45f

                  SHA1

                  6a0bc0d8ad24d7923c622a8a5011ff9c14ed8690

                  SHA256

                  20feac8a135c64dd144f1ff48e0bae1d5bd45962f1f853c8f3b55091e32e20f2

                  SHA512

                  da0678c11a4ed18fca819077a3c933a4603e2ed5cef65482d603559cd0b211eddf53b1575ad7a320283c0770a386c4c4d52847530b38fad43933f1cad8c2bc58

                  Download Submit

                • C:\debug.txt
                  Filesize

                  493B

                  MD5

                  9ed993e5d604e807ab63ca2e9e7c7824

                  SHA1

                  f94e11dfab203c2e7c57eb2807c35229037abc73

                  SHA256

                  54888899d35e287aeab584e88b0b38c2a9b8029fb33b64ad94e2e2a186d3cf94

                  SHA512

                  a56310683358cdbc58a2289247b94b53028fd98335c928c53a8a34a7bb655b202ce3db3394d33b5b35ed601c9b5e0f750482d352dda243a7dc02887fc2c8ee71

                  Download Submit

                • C:\debug.txt
                  Filesize

                  604B

                  MD5

                  fd9366c41f7804402b3096e937925dea

                  SHA1

                  6098097529821690ff2dbcdba0d1308355a33aee

                  SHA256

                  a36117cf1742022ab1aa8a7b51d444b3a8d5f864bf93ae40adb62e9e001256cb

                  SHA512

                  6d12ffe99370d98935b37149045019b20135fca2dea0f73d737562593250cabab2e79623207cb7f4b2fc295ae17f57be606dffcd965147193a51422d6ea55b12

                  Download Submit

                • C:\debug.txt
                  Filesize

                  698B

                  MD5

                  8e890b10cd3689d09263f09bb08ba39a

                  SHA1

                  5a37bccb7deb1a25157006e2cf33f300e27c79df

                  SHA256

                  e969fbfa72730384ea15683d3530eeb63d1e56b39cf89592b2334c636f86e70c

                  SHA512

                  70f614c6e0ff2d21e08bc1777253a3cabd3ab7c4bb50daabd80c8c3e5d48348beb3d401eaa6b93bd72652a5587bf81f1a9c975d5d584448c6bfaa24364f4bfbb

                  Download Submit