Overview

overview

4

Static

static

3

oMrongStealer.exe

windows7-x64

4

oMrongStealer.exe

windows10-2004-x64

1

oMrongStea...st.exe

windows7-x64

3

oMrongStea...st.exe

windows10-2004-x64

3

x.dll

windows7-x64

1

x.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    94s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 23:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    oMrongStealer.vshost.exe

  • Size

    22KB

  • MD5

    00c54466cfc232e2ba1dfc4f3a679f05

  • SHA1

    59bedfb34a5e6dc19724bab57aa72a2ddd9f76b0

  • SHA256

    099923b629ff4309a579a66eaa857de4e5d5caa093b6226ee7c491742d9168e9

  • SHA512

    a82bff5bd94a26fcb11d50213ff85076b3856b3f16259f8ff7ec6842b933d25e369f50c978ec9c5be589683dcdd1d5f7d5c7d093d71e737cc3f60a43f7b49416

  • SSDEEP

    384:JC3PZcWoWWnb/B0GftpBjPTl0qH3HRN7mF+lCY9uSX:I/U+iRB0qHuq3

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\oMrongStealer.vshost.exe
    "C:\Users\Admin\AppData\Local\Temp\oMrongStealer.vshost.exe"
    1⤵
      PID:3364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 804
        2⤵
        • Program crash
        PID:4584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3364 -ip 3364
      1⤵
        PID:3768

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3364-0-0x000000007523E000-0x000000007523F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3364-1-0x0000000000B30000-0x0000000000B38000-memory.dmp

        Filesize

        32KB

        Download