Overview

overview

7

Static

static

3

19ee83e8c7...77.exe

windows7-x64

7

19ee83e8c7...77.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 23:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe

  • Size

    1.1MB

  • MD5

    f3b8e5108ed78f877db961bbb304e020

  • SHA1

    47bc9311be4cf686e1ba27ea51f443eaf21e2708

  • SHA256

    19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377

  • SHA512

    02e81508f5c98f4cd271aeeaa0fd758c4b22499c1a8ded2815fca85792d4d65a3e1d4ccfe7f0eef265491121f6b4a7898b42a90476553545ee0480b17fe49b2e

  • SSDEEP

    24576:oWGc+rmTY9tR2dpGLWMXtDt01O+BN+3EO3+5HbWdog5+:VxTY9t4d6F9KE53HIKos+

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe
    "C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe
      "C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe
        "C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2164
    • C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe
      "C:\Users\Admin\AppData\Local\Temp\19ee83e8c7f21f53b5f8315e8345864bb5b65b10d1b1da5396582efdd68e8377.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\brasilian animal lesbian [bangbus] titts .zip.exe
          Filesize

          164KB

          MD5

          a8b6006a10f691edc4fbfdc031aa9208

          SHA1

          571900346682592f8ee1c82e4c0c63b92546d071

          SHA256

          037fbf5f86ce50e60d24be0ae0f29d2c9abb887fba7780eac0ecab8cea929cac

          SHA512

          6c67aa1e25c0b661ab08bb8edc1084d03e4b1a0984a5672bba0614066caa676da5195769a71d4b213bf42f61e774a29711b8a0666e5af4204c3d0127185ecbba

          Download Submit