Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19/08/2024, 14:31
General
-
Target
09e9d701097d04698f79e1666583d8d0N.exe
-
Size
3.2MB
-
MD5
09e9d701097d04698f79e1666583d8d0
-
SHA1
3ed675da18525a87f7ca9cc8012f58fc36eeb7ff
-
SHA256
a731a29140de578595f9047680b811c89ea3c33f5a05cff251fbf104e4f3c542
-
SHA512
0ed99d85158d559e2d7f3ea32c969a6e23c8a465d9cef9d7875066cccf63b13c173bb13c196c74fbbf7672382000f8f24173a36799585bb77f23055a259989b2
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBsB/bSqz8b6LNXJqI20t:sxX7QnxrloE5dpUpbbVz8eLFcz
Malware Config
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09e9d701097d04698f79e1666583d8d0N.exe"C:\Users\Admin\AppData\Local\Temp\09e9d701097d04698f79e1666583d8d0N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysdevdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\AdobeRH\devoptiec.exeC:\AdobeRH\devoptiec.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD57fce89a7f459847c3af67a2995a541a1
SHA13d01ef128191647875ebcd9ac7400ec3fecfea93
SHA2564f8b7e1860958c4dbee24641b6a7a43279f4ef2c02e564486fa524d885171e18
SHA5120dfebb3d274c9b087ffbebc70c56ca6746861611ba7d1b0b734c68f9dc2d4ecc0dcd7789bddaaaa02433678316979955c13b7051c04fcdea0a7f9c81d8242c47
-
Filesize
3.2MB
MD51191c375fc3afde0985ccc7199eb1573
SHA1701e5a4037d93f08a37fb43e06651fbf99b8ea9f
SHA256f4ef66f6f4cab4b21b86de53ee90bf00a3fe409a93904d2cf1dfc6d7b0298fe3
SHA51215c11f265feaafaab628b2d55d88b49aba7386ea6ab2e4999ecf62e2be978cd4eb1287d77ec07d944cfd99353a0e79234f15b5232e8d3db7074252891639c48b
-
Filesize
175B
MD53bbda992e5495dee789273db14e50efb
SHA17411b3ab593fbe9cdb48e214729bf75a503d70dd
SHA256194bc06a9a3835f254261458d7c66ad2c26075e657e32683065840bce78d19cd
SHA5129f3bab4acaa59083cf515a1700090bdd60d2fdbd6bb33fe4bbb376899f2ae508ac21ee7c4e28abed0a7339eb97d338b02647ff9e0c8d0283e68300328f0e708a
-
Filesize
207B
MD516ade974017b78dfb90a69a752a3bb21
SHA115ff2151ad942e4aa2923bac917ac2dee514f832
SHA2560e3ad2636bb552cf5d8e02099d16730d19ffc2adc81f8e27fd22ceaa8902c710
SHA512c8c17908241b8744e23439bd7b10940f1ae8a47124e880a74944fb63c1cd8066a798df68edb71a745eb69002da5ef21a97e1c490f0bb74364808f77c24358068
-
Filesize
3.2MB
MD5e48d661d405656b79c381b40998575b2
SHA1bf41cc1f6bc61c83f43b5d434c0944277375fa62
SHA256aff4692c56b05edb34395038aecec3c45f615b04c77d8c4c8b43ec944b01f115
SHA5123451a4608c66b77b3420880fe75b8db488ae994de0a3373324b89413fe895d92c2d01d84d2072571d961988be2fcea5a07e4cf2b082698985fa900b4474d247c