Analysis
-
max time kernel
99s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2024, 20:50
Behavioral task
behavioral1
Sample
0c25ab9002449bf681d514daa035da10N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
General
-
Target
0c25ab9002449bf681d514daa035da10N.exe
-
Size
65KB
-
MD5
0c25ab9002449bf681d514daa035da10
-
SHA1
3b92190c0f0c740ada658e44a75e4fb98048dede
-
SHA256
fa55a8d5864a06a3eb14d516f44909ce2bc080722b6a6ec318eecc38746864dc
-
SHA512
77742546cd3a793e8f59f1aafbe3594f6cba410766cce6de324bebba0004b2dbc2d3525ddf32197baaf8b66f00df7391712b5b743b6003469b26f6e38eee709d
-
SSDEEP
1536:C5JeZFIF5l3I3CbUqdjMsGfwYz+TdspzH:C5wTIFT3uCZMjfn6pwb
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x0007000000023417-7.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2004 0c25ab9002449bf681d514daa035da10N.exe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\java\jdk-1.8\bin\javaws.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\office16\msoasb.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\32bitmapibroker.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\office16\setlang.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\msoxmled.exe 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\common.dbconnection64.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\jre\bin\jabswitch.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\office16\protocolhandler.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\common.showhelp.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\mozilla firefox\default-browser-agent.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jre-1.8\bin\keytool.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\office16\msohtmed.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\videolan\vlc\vlc.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\bin\rmiregistry.exe 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\office16\excel.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\office16\pdfreflow.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\fltldr.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\mozilla firefox\crashreporter.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\microsoft\edge\application\92.0.902.67\identity_helper.exe 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\google\chrome\application\123.0.6312.106\installer\setup.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\internet explorer\extexport.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jdk-1.8\jre\bin\jabswitch.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jre-1.8\bin\tnameserv.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft office\office16\dcf\common.dbconnection64.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\mozilla firefox\pingsender.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\microsoft\edge\application\92.0.902.67\bho\ie_to_edge_stub.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jdk-1.8\bin\jinfo.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jre-1.8\bin\kinit.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\smarttaginstall.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\microsoft\edgeupdate_bk\download\{1fab8cfe-9860-415c-a6ca-aa7d12021940}\2.0.0.34\bgaupdate.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\bin\servertool.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\jre\bin\klist.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\google\chrome\application\123.0.6312.106\chrome_pwa_launcher.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\office16\vpreview.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\msoicons.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\7-zip\7z.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\bin\jabswitch.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files (x86)\google\update\1.3.36.371\googlecrashhandler.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\microsoft\edge\application\92.0.902.67\cookie_exporter.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\7-zip\uninstall.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\bin\javadoc.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\common files\oracle\java\javapath\javaw.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jdk-1.8\jre\bin\klist.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\office16\msoasb.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\dw\dwtrig20.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\bin\jdeps.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\jre\bin\keytool.exe 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jdk-1.8\jre\bin\tnameserv.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\7-zip\7z.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\7-zip\7zg.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\java\jdk-1.8\bin\native2ascii.exe 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jre-1.8\bin\klist.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\java\jre-1.8\bin\servertool.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\videolan\vlc\vlc-cache-gen.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\acrobroker.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\plug_ins\pi_brokers\64bitmapibroker.exe 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\google\chrome\application\chrome.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\office16\msouc.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\microsoft office\root\office16\pptico.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\program files\microsoft office\root\office16\vpreview.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\wow_helper.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files (x86)\internet explorer\ielowutil.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\common files\microsoft shared\ink\inputpersonalization.exe.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\program files\7-zip\7zg.exe 0c25ab9002449bf681d514daa035da10N.exe -
Drops file in Windows directory 20 IoCs
description ioc Process File created \??\c:\windows\boot\dvd\pcat\WINLOGON.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\boot\dvd\pcat\WINLOGON.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\boot\dvd\pcat\buf.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.19041.1_none_8b38a4d923e0a37e\buf.txt 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\WINLOGON.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\LSASS.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\boot\dvd\pcat\CSRSS.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\boot\dvd\efi\SERVICES.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\boot\dvd\efi\SERVICES.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\boot\dvd\efi\buf.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\buf.txt 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\boot\dvd\efi\CSRSS.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\boot\dvd\efi\CSRSS.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\boot\dvd\pcat\CSRSS.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.19041.1_none_8b38a4d923e0a37e\WINLOGON.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\LSASS.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.19041.1_none_8b38a4d923e0a37e\CSRSS.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-b..nvironment-dvd-pcat_31bf3856ad364e35_10.0.19041.1_none_5008dee6cfdc303c\WINLOGON.EXE 0c25ab9002449bf681d514daa035da10N.exe File created \??\c:\windows\winsxs\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.19041.1_none_8b38a4d923e0a37e\WINLOGON.EXE 0c25ab9002449bf681d514daa035da10N.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-b..environment-dvd-efi_31bf3856ad364e35_10.0.19041.1_none_8b38a4d923e0a37e\CSRSS.EXE 0c25ab9002449bf681d514daa035da10N.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4760 wrote to memory of 2004 4760 0c25ab9002449bf681d514daa035da10N.exe 84 PID 4760 wrote to memory of 2004 4760 0c25ab9002449bf681d514daa035da10N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c25ab9002449bf681d514daa035da10N.exe"C:\Users\Admin\AppData\Local\Temp\0c25ab9002449bf681d514daa035da10N.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\0c25ab9002449bf681d514daa035da10N.exe.exeC:\Users\Admin\AppData\Local\Temp\0c25ab9002449bf681d514daa035da10N.exe.exe2⤵
- Executes dropped EXE
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD55d88ebcc4a25f6f7175190b189f95539
SHA149bfdde38663ec123a34de8abc78b0f95c9996e8
SHA2565a2b44873feba45bc86c885e6c32d35951bbae3196757ad13b760d54b3e9b50e
SHA512843c649b963dfe150f8a9aa1783af8b2d5c1a7be71743b54f3ecf9890612e8a2dc54d70f54375cad6773cd39056f852f9dc96fc541e0d831f2d84699168b1362
-
Filesize
33KB
MD57efd8a704971da5659e34d4b50636c17
SHA12ca57ea20f265fc9067880e57952ff4db488559b
SHA256739773819e8656574c80c1c448edf372bbab0b7fc8210150dd77f54c9d6d7d5e
SHA512385b83802eaf4f0fdaa4f3de1b7649b3dde8c95ab6d18ca198d739610d2109c3cb0de4d10137a657fb26b6b746e300c813667512b265c72a49e26941aa6221c3