Overview

overview

7

Static

static

3

14b133bd86...4a.exe

windows7-x64

7

14b133bd86...4a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 19:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe

  • Size

    2.1MB

  • MD5

    7285cf55e3c24ef001eb04454088ecf6

  • SHA1

    152037a6845a14aae397688c21721ee09ec149fb

  • SHA256

    14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a

  • SHA512

    cc3995d15cae822803323c9538cdb17aa6ceb08324202530cd61f27d54d3677faa54e05b64c8b1619b01b043cf5b9299e0af5db7a644adab2e74bfb9e59231d8

  • SSDEEP

    49152:5SHTyBaHTzHg+gSWZavWo63/25MBmrhmtw:STyKPA+gSao63jmrAw

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe
    "C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe
      "C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe
        "C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3912
    • C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe
      "C:\Users\Admin\AppData\Local\Temp\14b133bd8639411ef6b6763659a7046e9b1c3e12585fd5879920217d65f3654a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:5032

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian porn lingerie [milf] granny .rar.exe
          Filesize

          1.2MB

          MD5

          3c1668735f97e108eaddcbdf2a7316aa

          SHA1

          ec0ab0cbcb8c582c9e80301eefd0797a26434254

          SHA256

          4c0d738fd5931252cc450bd57d9b0fa24121ad4347676b7da011f6e0ca1780c9

          SHA512

          0ba99a39f34ef88faf442bcdddab471eda1106c0d7c74a67105437787549d731741445923faa2f1aeb9550274f0139a7713d8e600bdaa1d6427ae5912b734660

          Download Submit