Analysis
-
max time kernel
135s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 20:37
Behavioral task
behavioral1
Sample
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe
Resource
win10v2004-20240709-en
General
-
Target
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe
-
Size
1.0MB
-
MD5
0a48fdb4519cfd9d0e03a5ed1c2333c6
-
SHA1
5929cda67aee22ecb44c00d3334d25b7d27ae6a5
-
SHA256
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2
-
SHA512
954fd758b3bf2f3134ff7a3849937a9a47e7d872a0d09917b954dad4f5b347242b2453da49e05a0cdc399d214b1be11f1ba453eb205b3c51694089fa6db717df
-
SSDEEP
24576:7Zylsdd2JYkHarbgE1FoBUb8jQaqBDlhbvC4y9iGaITD:iOjmarh1GBCZDlhbvCkGaIX
Malware Config
Signatures
-
PureLog Stealer
PureLog Stealer is an infostealer written in C#.
-
PureLog Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1708-1-0x0000000000040000-0x000000000014C000-memory.dmp family_purelog_stealer -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exedescription pid process target process PID 1708 set thread context of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
timeout.execmd.exetimeout.exe2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 4052 timeout.exe 3904 timeout.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exedescription pid process Token: SeDebugPrivilege 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe Token: SeDebugPrivilege 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.execmd.execmd.exedescription pid process target process PID 1708 wrote to memory of 2520 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe cmd.exe PID 1708 wrote to memory of 2520 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe cmd.exe PID 1708 wrote to memory of 2520 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe cmd.exe PID 2520 wrote to memory of 4052 2520 cmd.exe timeout.exe PID 2520 wrote to memory of 4052 2520 cmd.exe timeout.exe PID 2520 wrote to memory of 4052 2520 cmd.exe timeout.exe PID 1708 wrote to memory of 1696 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe cmd.exe PID 1708 wrote to memory of 1696 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe cmd.exe PID 1708 wrote to memory of 1696 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe cmd.exe PID 1696 wrote to memory of 3904 1696 cmd.exe timeout.exe PID 1696 wrote to memory of 3904 1696 cmd.exe timeout.exe PID 1696 wrote to memory of 3904 1696 cmd.exe timeout.exe PID 1708 wrote to memory of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe PID 1708 wrote to memory of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe PID 1708 wrote to memory of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe PID 1708 wrote to memory of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe PID 1708 wrote to memory of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe PID 1708 wrote to memory of 5096 1708 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe 2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe"C:\Users\Admin\AppData\Local\Temp\2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 102⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 102⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe"C:\Users\Admin\AppData\Local\Temp\2eb9d2a67aa9761b996f932affd2deab03145b56b96cb9f9ceebfbffc9e866a2.exe"2⤵
- Checks SCSI registry key(s)
PID:5096