Overview

overview

7

Static

static

3

4b49acfde6...68.exe

windows7-x64

7

4b49acfde6...68.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2024, 21:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe

  • Size

    1.5MB

  • MD5

    67a88dff928c35523667acac2ffe6e97

  • SHA1

    ebf6b73069abc55a6b72a8e19f650a5bf6f30e92

  • SHA256

    4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68

  • SHA512

    0316f4128ad8bba06eba8667bd24cda09b04df911067f73df31c98e4d2cd3091010b61fa759fd375bdaf6eb9d326c76ca4454aeaac11e9a951f1ee8be1449467

  • SSDEEP

    49152:VoBA3jTh5yCvm1KzwuTDfLetQifH1Bf9nMBO:39vouTHetLP1Bf9nMo

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe
    "C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe
      "C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe
        "C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2496
    • C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe
      "C:\Users\Admin\AppData\Local\Temp\4b49acfde6a4d8434876935ad96935f69d05ee105cb623ca60debddea03bef68.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2504

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Windows Sidebar\Shared Gadgets\fetish fucking [free] glans .avi.exe
          Filesize

          1.4MB

          MD5

          defa77cb7f66f56600d365ea3bf46864

          SHA1

          0f26c2a43d3325dd753f72e3f8746323867a339b

          SHA256

          d70ac7baa53b64bead9bae8789a28cb6bea70847952cc957edb3a9eb1f1c5a3f

          SHA512

          2726d710db060386c9260e74c7869e0b41c774f35d9e3d0324833138ba99cb0bbb69e608ee658b03756572c663f14732a329355873c16e32e08b85b464e9d292

          Download Submit

        • memory/1980-0-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

          Download

        • memory/1980-8-0x0000000004EE0000-0x0000000004F0B000-memory.dmp

          Filesize

          172KB

          Download

        • memory/2496-31-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

          Download

        • memory/2504-32-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

          Download

        • memory/2740-9-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

          Download

        • memory/2740-30-0x0000000004530000-0x000000000455B000-memory.dmp

          Filesize

          172KB

          Download