windealer | 28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Size

364KB
MD5

cc7207f09a6fe41c71626ad4d3f127ce
SHA1

84e749c37978f9387e16fab29c7b1b291be93a63
SHA256

28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa
SHA512

c7f236f1bafa9192ba30f40b6cbc0e74c89a5b4d7ae95fa98d1ace3857849ba37d2211a2c42bb4f348bd218e1ce28a7006bbda07e3e1e51c09a806da17f9f655
SSDEEP

6144:FrbPUOKGKoeokhUj6UNOuGAT0EWkxKthr97veIHyqxiRix0jpuqVcM3B:dTULGKoBkhUj6G6eKT9DeCS3qaB

Score

10^/10

windealer discovery stealer trojan

Malware Config

Signatures

Detect WinDealer information stealer 7 IoCs

stealer

resource	yara_rule
behavioral2/memory/4808-0-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral2/memory/4808-1-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral2/memory/4808-7-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral2/memory/4808-8-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral2/memory/4808-6-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral2/memory/4808-9-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer
behavioral2/memory/4808-24-0x0000000010000000-0x000000001003B000-memory.dmp	family_windealer

WinDealer
WinDealer is an info stealer used by LuoYu group.
stealer trojan windealer

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4808	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
4808	28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe

C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe
"C:\Users\Admin\AppData\Local\Temp\28df5c75a2f78120ff96d4a72a3c23cee97c9b46c96410cf591af38cb4aed0fa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8e98-fb8010fb\F_tmp

Filesize
121B

MD5
81ce283f1e793cdac18e30347d784778

SHA1
b6dcaf5f3b3ce651f263cd3407228b22d7ce6c2f

SHA256
3bc9d4d55a817da7fe06fb9cb4b58b6bf4ef1a4df273572caddd4b518021c716

SHA512
5f4e48073b32644bea135d36d92fbbf602d180369505ee5d0f12154aeb665092c04db8a9e354e1f23541596f61634cd57191c29ed0ddcd979b064e943abff786

Download Submit
memory/4808-0-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4808-1-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4808-7-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4808-8-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4808-6-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4808-9-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download
memory/4808-24-0x0000000010000000-0x000000001003B000-memory.dmp

Filesize
236KB

Download