Resubmissions
12-08-2024 12:54
240812-p49pka1hqp 1012-08-2024 11:14
240812-nb7ttssgjb 1026-06-2024 06:16
240626-g1gwdazbqd 10Analysis
-
max time kernel
59s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2024 12:54
General
-
Target
0cdf89055417947a9ad53cf38eb0f75e.exe
-
Size
158KB
-
MD5
0cdf89055417947a9ad53cf38eb0f75e
-
SHA1
a6d845cd643409201b603f3918c4c45b9afb8111
-
SHA256
3b949e360f85236eb66eafa4eeda2ffffb0fb01562767550e75dfb4bf09f0eaf
-
SHA512
8a2523617d4f3c68bd76c9c6f9da358d933b5e71312e25c8ce3a095c3225ba2abea0873ba0c895dea7c374346d3cda5a030557a895b990f1d7a623adb2d2aa20
-
SSDEEP
3072:hQH5iOMxGNftsLz4oPFKUQgC6OEYkUjUMNW82QZRaop5:hQNMxGNVwtB7OEAoWRa
Malware Config
Extracted
Family
stealc
Botnet
3
C2
http://93.123.39.132
Attributes
-
url_path
/129edec4272dc2c8.php
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cdf89055417947a9ad53cf38eb0f75e.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1888 taskmgr.exe Token: SeSystemProfilePrivilege 1888 taskmgr.exe Token: SeCreateGlobalPrivilege 1888 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe 1888 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cdf89055417947a9ad53cf38eb0f75e.exe"C:\Users\Admin\AppData\Local\Temp\0cdf89055417947a9ad53cf38eb0f75e.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4988
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1888