Resubmissions
12-08-2024 12:54
240812-p49pka1hqp 1012-08-2024 11:14
240812-nb7ttssgjb 1026-06-2024 06:16
240626-g1gwdazbqd 10Analysis
-
max time kernel
90s -
max time network
86s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2024 11:14
General
-
Target
0cdf89055417947a9ad53cf38eb0f75e.exe
-
Size
158KB
-
MD5
0cdf89055417947a9ad53cf38eb0f75e
-
SHA1
a6d845cd643409201b603f3918c4c45b9afb8111
-
SHA256
3b949e360f85236eb66eafa4eeda2ffffb0fb01562767550e75dfb4bf09f0eaf
-
SHA512
8a2523617d4f3c68bd76c9c6f9da358d933b5e71312e25c8ce3a095c3225ba2abea0873ba0c895dea7c374346d3cda5a030557a895b990f1d7a623adb2d2aa20
-
SSDEEP
3072:hQH5iOMxGNftsLz4oPFKUQgC6OEYkUjUMNW82QZRaop5:hQNMxGNVwtB7OEAoWRa
Malware Config
Extracted
Family
stealc
Botnet
3
C2
http://93.123.39.132
Attributes
-
url_path
/129edec4272dc2c8.php
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cdf89055417947a9ad53cf38eb0f75e.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 96 taskmgr.exe Token: SeSystemProfilePrivilege 96 taskmgr.exe Token: SeCreateGlobalPrivilege 96 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe 96 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cdf89055417947a9ad53cf38eb0f75e.exe"C:\Users\Admin\AppData\Local\Temp\0cdf89055417947a9ad53cf38eb0f75e.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3608
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:96