Overview
overview
10Static
static
10GetInfo.exe
windows7-x64
3GetInfo.exe
windows10-2004-x64
3IDBLK_TIMING.dll
windows7-x64
3IDBLK_TIMING.dll
windows10-2004-x64
3MPALL_F1_E...0D.exe
windows7-x64
10MPALL_F1_E...0D.exe
windows10-2004-x64
10MPALL_F2_v363_0D.exe
windows7-x64
10MPALL_F2_v363_0D.exe
windows10-2004-x64
10MPParamEdit_F1.exe
windows7-x64
3MPParamEdit_F1.exe
windows10-2004-x64
3MPParamEdit_F2.exe
windows7-x64
3MPParamEdit_F2.exe
windows10-2004-x64
3inpout32.dll
windows7-x64
8inpout32.dll
windows10-2004-x64
8Analysis
-
max time kernel
81s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 02:50
Behavioral task
behavioral1
Sample
GetInfo.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
GetInfo.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
IDBLK_TIMING.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
IDBLK_TIMING.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
MPALL_F1_EC00_v363_0D.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
MPALL_F1_EC00_v363_0D.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
MPALL_F2_v363_0D.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
MPALL_F2_v363_0D.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
MPParamEdit_F1.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
MPParamEdit_F1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
MPParamEdit_F2.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
MPParamEdit_F2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
inpout32.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
inpout32.dll
Resource
win10v2004-20240802-en
General
-
Target
MPALL_F1_EC00_v363_0D.exe
-
Size
2.0MB
-
MD5
035254b6d72c5ca8fbc429f7ada9b35a
-
SHA1
41beb7620a9f97dd1cae11f54bfe1c463a40ab02
-
SHA256
e1c240ec6e3e830c3faab7d1da32512d1f79cf9df14b7f012a446e28f3d5b5cd
-
SHA512
099d0d86989434f87b52b312cb779539d2eeb9253d9932cecae98a842b0f738686f31eae89dfb07df39974305716eb348660e51a0db7cb7086ccd5eda8d700e8
-
SSDEEP
49152:m10+k5MqYJbQqDH/4vBC9rB/O0K4dxoO7:tMqY5QqDHGBC9rxO0RD7
Malware Config
Signatures
-
Detects Strela Stealer payload 2 IoCs
resource yara_rule behavioral5/memory/580-1-0x0000000000400000-0x000000000063C000-memory.dmp family_strela behavioral5/memory/580-9-0x0000000000400000-0x000000000063C000-memory.dmp family_strela -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Drivers\hwinterface.sys MPALL_F1_EC00_v363_0D.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPALL_F1_EC00_v363_0D.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 480 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 580 MPALL_F1_EC00_v363_0D.exe 580 MPALL_F1_EC00_v363_0D.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 580 wrote to memory of 332 580 MPALL_F1_EC00_v363_0D.exe 29 PID 580 wrote to memory of 332 580 MPALL_F1_EC00_v363_0D.exe 29 PID 580 wrote to memory of 332 580 MPALL_F1_EC00_v363_0D.exe 29 PID 580 wrote to memory of 332 580 MPALL_F1_EC00_v363_0D.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\MPALL_F1_EC00_v363_0D.exe"C:\Users\Admin\AppData\Local\Temp\MPALL_F1_EC00_v363_0D.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\regini.exeregini.exe C:\Windows\temp\MPALL\ug.ini2⤵PID:332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140B
MD52531ba43062c4841d9948476b5987e69
SHA14740ec722eb32e0edd508428bad063868d762799
SHA256b34d4cc5781c61160efac6fe5b381ec8e24a0dadb423c00a7fb31ddde78765e8
SHA512ff88e51be8fc64a80d0f72e279c547d3b55197092856cf60bfb15831485a8ec85026f2714f0d56d21ce7c7c4918dd948fa61c645b54281d2ffc784f2809c4d4c