monster | fcd126d8aba6b536d6af04b669eed2d4fa0db16142885df583d3925b84b16588

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe
Size

10.5MB
MD5

a5c740eb48fafb9b25d06c22b6f4a7e9
SHA1

70a24d83379e205bbbcda72da177fa0baae2be7f
SHA256

93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8
SHA512

524b83c112064bafbec17b43ef03f5f41888c584fc0baf2da59e58befa40b4cb7920f6e4a6f598289749919fbf7394a74352c0b301d1d1594e133aaf96cd3808
SSDEEP

196608:2eoNf7uyka/QRjnlhJPPyEhQVM1LPg8TFhaF08ckcNy9i4KuZp2E8rK:27NFEj3pHhQVEPg8TFhN8eOPKuX2EV

Score

10^/10

monster stealer

Malware Config

Signatures

Detects Monster Stealer. 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016ceb-35.dat	family_monster
behavioral1/memory/2732-40-0x000000013F540000-0x0000000140566000-memory.dmp	family_monster

Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster

Executes dropped EXE 1 IoCs

pid	Process
2732	stub.exe

Loads dropped DLL 2 IoCs

pid	Process
2672	93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe
2732	stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2732	2672	93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe	30
PID 2672 wrote to memory of 2732	2672	93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe	30
PID 2672 wrote to memory of 2732	2672	93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe	30

C:\Users\Admin\AppData\Local\Temp\93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe
"C:\Users\Admin\AppData\Local\Temp\93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\onefile_2672_133684376604204000\stub.exe
  C:\Users\Admin\AppData\Local\Temp\93429472073d0794c411a71f2f161aa8d7b8c51606ab497175cc5863fea7fba8.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\onefile_2672_133684376604204000\python310.dll

Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2672_133684376604204000\stub.exe

Filesize
15.9MB

MD5
fd8750fd175eb370b023e8c537e9c3fe

SHA1
7e97e886cc82b71781562944eb6b3f792d809739

SHA256
f45051c87cc2e70f1da0ba5ad074f2ff3e29eb02afd4b3a65a7b15506966fc9b

SHA512
73312816a2778aeb4876ccf61559196d8ba44f87d6149f0c1da7b34b1af983f055eb541b82d36d533a2d5f42a8f4bf61d9b0adaf10bb49bf08549293c77de57f

Download Submit
memory/2672-75-0x000000013FB60000-0x0000000140607000-memory.dmp

Filesize
10.7MB

Download
memory/2732-40-0x000000013F540000-0x0000000140566000-memory.dmp

Filesize
16.1MB

Download