Analysis
- max time kernel
140s - max time network
17s - platform
windows7_x64 - resource
win7-20240705-en - resource tags
- submitted
02/08/2024, 17:07
General
- Target Gross Beat 1.0.7/setup.exe
- Size 11.7MB
- Sample240802-vm97nasdjm
- SHA256 b13ade9fa58f96d8f03e4e241455c1af226d6b654e2ad48a8ae7d3a61f7ad64d
Malware Config
Signatures
- Detects Strela Stealer payload 2 IoCs
- Strela stealer
An info stealer targeting mail credentials first seen in late 2022.
- Loads dropped DLL 8 IoCs
- Drops file in System32 directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gross Beat 1.0.7\setup.exe"C:\Users\Admin\AppData\Local\Temp\Gross Beat 1.0.7\setup.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ioSpecial.ini
AdvSplash.dll
Bass.dll
InstallOptions.dll
NSIS_SkinCrafter_Plugin.dll
SkinCrafter.dll
System.dll
mfc71.dll
msvcr71.dll
memory/712-121-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-124-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-29-0x0000000004610000-0x0000000004BDD000-memory.dmp
memory/712-23-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-13-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-14-0x0000000001F0C000-0x0000000001F0D000-memory.dmp
memory/712-22-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-122-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-123-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-37-0x0000000004BE0000-0x0000000004CAC000-memory.dmp
memory/712-125-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-126-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-127-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-128-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-129-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-130-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-131-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-132-0x0000000001EC0000-0x0000000001F0D000-memory.dmp
memory/712-133-0x0000000001EC0000-0x0000000001F0D000-memory.dmp