Overview

overview

7

Static

static

3

3c4121ce5b...96.exe

windows7-x64

7

3c4121ce5b...96.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05-07-2024 20:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe

  • Size

    669KB

  • MD5

    ea4cf97325f044e314e67b5187f91501

  • SHA1

    14413b86f40e6f096196a73838df86d34ac9214d

  • SHA256

    3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96

  • SHA512

    296d010d977ab1600d5f54c03f917a90f2b1e06c8cbe168da45e57be64cb011b5bd49ae51e60893833c42af5d32f90274f94754a948c1660781740a68b023215

  • SSDEEP

    12288:dXCNi9BvbVaco8XJ73rwRZRDy0WDGFg2d6mWAQOi3EN1sQwTL:oWvbVaj8Z7EW0rFDd6mWpOnN2Qwv

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe
    "C:\Users\Admin\AppData\Local\Temp\3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Users\Admin\AppData\Local\Temp\3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe
      "C:\Users\Admin\AppData\Local\Temp\3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\AppData\Local\Temp\3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe
        "C:\Users\Admin\AppData\Local\Temp\3c4121ce5b65c96a292021c2f9e61318469fcd74609e99bedbfd9778b635cb96.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Sidebar\Shared Gadgets\trambling [milf] titts mature .rar.exe
    Filesize

    1.7MB

    MD5

    1bdd1a7d667bab483c838c5c97b24a78

    SHA1

    2cde5e92ca0fda6ac1ae7bd042c92351f3e7ff82

    SHA256

    c724af5fbdf639ba83a46f4273e83d14bec472a050e2f2c0b18c3b80cba882d1

    SHA512

    ef739298b5a90b63eeeb9d929e0ce72647a297da0f85d0069390ac46092faae273aebdb33ccc7c3a0b984ab30f86a7d1672e8785654b196b556c471f6a5fb73d

    Download Submit

  • C:\debug.txt
    Filesize

    183B

    MD5

    5dfcdffa9336696c640d23de145d7e20

    SHA1

    a9f13b70abd5a959a568bc0a1f7a7747491285bd

    SHA256

    71f6a85a94131e5df098ca6e2e5cc04b0138f16b7c34b297cb889f09fb510316

    SHA512

    06bb2c12551a8db607f4418f94f9bac2c07f49baf91533454e6b67ea433b44ede44e8820b04bde681c5d6e402b439e331767ed8b4056527abd8e449709edd19b

    Download Submit

  • memory/2584-89-0x0000000004DE0000-0x0000000004E0B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/2624-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

    Download

  • memory/2624-77-0x00000000053A0000-0x00000000053CB000-memory.dmp

    Filesize

    172KB

    Download