Overview

overview

7

Static

static

3

ab69825f2b...90.exe

windows7-x64

7

ab69825f2b...90.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 00:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe

  • Size

    1.6MB

  • MD5

    83f1f1c2d591f867e594daedfe119ef4

  • SHA1

    e6231b15b8e486c614ba659082925bc5c717e370

  • SHA256

    ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490

  • SHA512

    23d6070b9a9f613c9ff13c6af09e6ff39dd1528b732d0d4ccbfba840d589e3c752b9cad23c0bc115cf46bf9c11da1c68a4ae12a621c1c15cab103b310ede6f41

  • SSDEEP

    49152:Vk2lWrFjq7ojAYME+9nK845CBkMKo3yZPd5m0LBEb:tk7ArH9n/sCBOok15m0LSb

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe
    "C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe
      "C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe
        "C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3640
    • C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe
      "C:\Users\Admin\AppData\Local\Temp\ab69825f2b4ff464af59b72fe5ff7228f939769a1c71d7e07e7ab0cbcb79e490.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian action xxx big titts hotel .mpeg.exe
    Filesize

    123KB

    MD5

    3eba3e578a5a953c93acc1eda76829d4

    SHA1

    48cbb10d378ad083dcbdf271ce88bf54cab7243b

    SHA256

    59236ab5ab67088939618b706106f3d6bb914f48e2a8ba3c7e11e403c276c51d

    SHA512

    43ed03da80be0f388d27bb756d3c68e9adb054c052d9c87b1e7834a17eaae2379e45eaeb93669d494f20cbd9b1909f1b9893aec88413392dd4219955b018b176

    Download Submit

  • C:\debug.txt
    Filesize

    146B

    MD5

    c7e7aeac5613934952340e81817c3680

    SHA1

    944e8f624226fdcb5c501e9201076abffe3d5b30

    SHA256

    80e9e70f3cc59371e2ee5776c27075f555b652ff33e8af85e4eb6811a9397f08

    SHA512

    e3364ec05d6ceeecfc865be5195275fe9dabcdfb6e212e4e513f6089314e29aff74a5ab8a98509f40aff201246ae71e58b693d6a02a083e54dd8dc8be2f84ad5

    Download Submit