Overview

overview

7

Static

static

3

1383a84b35...d5.exe

windows7-x64

7

1383a84b35...d5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 19:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe

  • Size

    556KB

  • MD5

    3f430d7cb9b35dca2c1b5bd97dc35dc2

  • SHA1

    57cb573ecd71272f9f3eefd1e5cb7cff8c260e1b

  • SHA256

    1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5

  • SHA512

    e41259c2bdf972535bb46bef2d0a91044e1687f56d65e0b0f08831b42aa11a465ca7d25038593856881ba2233de8c1a0ff195aa65756cd8abce88180845c927b

  • SSDEEP

    12288:JXCNi9BWWre0axaLdiFzNNBBX0LFB7DqDFmAgH4Cqb1IKKB9ylk/bh5MKcVp:sWGZaL01c7mDFmAgGRIKKSk/b/MKcP

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe
    "C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe
      "C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe
        "C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1956
    • C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe
      "C:\Users\Admin\AppData\Local\Temp\1383a84b35a27b4d6c6aa6655e894a1f2f019e468b117a182981e1e2a230e0d5.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4728
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 548
      2⤵
      • Program crash
      PID:3568
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3212 -ip 3212
    1⤵
      PID:4288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\brasilian beast full movie hairy .avi.exe
      Filesize

      1.5MB

      MD5

      3c0b6ec4e3bbddf3767b2d3ea66eafc1

      SHA1

      8d38bfb5f66f5200f7fa2c4457651e91d2c776ef

      SHA256

      58acaea0ae7cbe08a92181f62d59483dfb707e343d7dbd4e6e5231b17361d36a

      SHA512

      2dba8b4c5a9b54c44b84cbd5fb04b4dc4b2d7cec98d056b8bb66bd4a00718b576e5e6b2535c414bdd1ed64581071906bdff15f71fc2026146c48497ef5bb6676

      Download Submit