Analysis

  • max time kernel
    125s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 02:50

General

  • Target

    MPALL_F2_v363_0D.exe

  • Size

    2.0MB

  • MD5

    a7db016538604761b783789753b8a8fd

  • SHA1

    e6e708b04d323f7e79084b290efb21dcb647628f

  • SHA256

    4062dc237b1cdda4f74e506f4d71298ed3b9b2a5a22dd8963fcc95420d1737d6

  • SHA512

    99cceb5d60da573ff18bb638fcefb0df3c4ab76009edb7f15811296395969585ea20ab7f68ba2def98821bbbd64021fc5c8e1a4a1b4f65a8342c21cdfff82712

  • SSDEEP

    49152:lLF8qlqvgeOdaHWelBLBy2yO7O0k2O6O7:JlqvZOdaHVB1ty2O087

Malware Config

Signatures

  • Detects Strela Stealer payload 2 IoCs
  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

  • Drops file in Drivers directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MPALL_F2_v363_0D.exe
    "C:\Users\Admin\AppData\Local\Temp\MPALL_F2_v363_0D.exe"
    1⤵
    • Drops file in Drivers directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\SysWOW64\regini.exe
      regini.exe C:\Windows\temp\MPALL\ug.ini
      2⤵
        PID:2496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\temp\MPALL\ug.ini

      Filesize

      140B

      MD5

      2531ba43062c4841d9948476b5987e69

      SHA1

      4740ec722eb32e0edd508428bad063868d762799

      SHA256

      b34d4cc5781c61160efac6fe5b381ec8e24a0dadb423c00a7fb31ddde78765e8

      SHA512

      ff88e51be8fc64a80d0f72e279c547d3b55197092856cf60bfb15831485a8ec85026f2714f0d56d21ce7c7c4918dd948fa61c645b54281d2ffc784f2809c4d4c

    • memory/2140-0-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2140-6-0x00000000029F0000-0x0000000002D2D000-memory.dmp

      Filesize

      3.2MB

    • memory/2140-9-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB