Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
02-07-2024 07:16
General
-
Target
BrainChiperbeneran.exe
-
Size
147KB
-
MD5
448f1796fe8de02194b21c0715e0a5f6
-
SHA1
935c0b39837319fda571aa800b67d997b79c3198
-
SHA256
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
-
SHA512
0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
-
SSDEEP
3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4
Malware Config
Extracted
C:\sYMY1N6ah.README.txt
http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BrainChiperbeneran.exe"C:\Users\Admin\AppData\Local\Temp\BrainChiperbeneran.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\170A.tmp"C:\ProgramData\170A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\170A.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b2b9c0bac49fd886d5b1b4b9b57b5505
SHA195b95151cdcf6839eca47e96737f72f9a2a12921
SHA256eb5b3721c3c0c7945fb7c58054af06ed497c64612aa344595348a20fde46e4c3
SHA512229643e96bc8617006d7723b148ca3a4f8e82de0fc84a052520bafb5bf4a94e6f6832f5551e5e253637e66c432f073745fe60247af40b3ca72e0b868af6eedec
-
Filesize
147KB
MD512db5289554e18c7d375198f6b16f738
SHA1692b865da314799916e4f3e3fbf19c64fbff8ca1
SHA256da68abf371f0496b2f228be04c4de4dc387a42432ceccdef634b3c9b8cc16245
SHA512e79791ef5ce18e4f99d3c7e6bb5952e5a43bbd30c4d42f27384ec822e4a5bd45c82896c6bb0584ed946a3bc45b4bb66f49ecc56ddc77ce2d7df7b3c6165a8885
-
Filesize
1KB
MD5deb2e0756d331362d57ad9fe408c4ff3
SHA1870865aad7c7cccafbca0c1f50f7eecaedbd4bf1
SHA2561ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c
SHA512e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6
-
Filesize
129B
MD5c00c84e00dab414c346d9050aa70d60f
SHA1d7d0d824f3e4261456cd7611cc317658d696737c
SHA256dcc9e7378aa656cca0eee191b807412fa358cb90065fd0cb2b151e438d90d926
SHA51288abbad5e6d493c4835d61a2dbebef2dcc78c4cb8abea8900648519c54ac4eb1389754541f68dd884241ef9694dd2f18df542cd31908138d46fe84c5095fffd0
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB