Analysis
-
max time kernel
265s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 17:04
General
-
Target
ploader.zip
-
Size
1.4MB
-
MD5
af181e3c3fc39d9219582e19457e30a8
-
SHA1
030f096fa4f9afec1d1bc6530573a2c97c5c64c2
-
SHA256
b7644b450c5c7189be0ff4109d2042cf74038eaa0503258f5c77ae3818d24a59
-
SHA512
16a059536a023215316a78d52394c1fac1e67d9ca90db13a78ca4e1df19e8732e6b1c9231222c743afd07ec6fc0d62faebb2cffd6741c71d5daa1f05415f1aba
-
SSDEEP
24576:KBsGSayaBzZmE95jNGqGHUqPJyy8fI5zOiwIJ/TeyOE5Q3XUqSmiif9Ct3SXdoht:K+vnG15rQdPJ8KzOIJd5OtH9C+GebO
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ploader.zip2⤵
-
-
C:\Users\Admin\Desktop\ploader\Simpson.pif"C:\Users\Admin\Desktop\ploader\Simpson.pif" C:\Users\Admin\Desktop\ploader\H2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\Desktop\ploader\RegAsm.exeC:\Users\Admin\Desktop\ploader\RegAsm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
5.2MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
696KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
1.1MB
-
Filesize
4KB