Overview

overview

9

Static

static

3

ebaa8533f6...4f.exe

windows7-x64

9

ebaa8533f6...4f.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    130s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 11:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f.exe

  • Size

    1.5MB

  • MD5

    73242577c27ba46a1e13320688156b53

  • SHA1

    bc3027a78a791d2ed371e96293dfb4af8060893b

  • SHA256

    ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f

  • SHA512

    f19216a9a496b17f6455001b0f1c2daf0acfcd4533a7ed171a8619613538f4d50090f81001accc2bdcf463e3cbda91ebd9628e8484d422141e1eca09f06a2fda

  • SSDEEP

    24576:38KLbnHzGSbHFukT8Mle7q7LLS/85RkVtxjsE9DzIQtZW:380TG8FukT80eULSUfkV7j

Score
9/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f.exe
    "C:\Users\Admin\AppData\Local\Temp\ebaa8533f6f05ddb6bacd5e8a28d08c5eecbc696c32d3c1521b6a4ac9494e04f.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\8DBF.tmp
      C:\Users\Admin\AppData\Local\Temp\8DBF.tmp
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2356
    • C:\Program Files\Java\jre7\bin\javaws.exe
      "C:\Program Files\Java\jre7\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Program Files\Java\jre7\bin\jp2launcher.exe
        "C:\Program Files\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2704

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          Filesize

          471B

          MD5

          942dcef7c379600292af98b4633f28af

          SHA1

          a7017ffcec3c0cfb6c496016d93df64bedb6c3ef

          SHA256

          0dd71c8f26a5fdd40b514b951f0b695ecdc74eefa0a430cddc6cf9373f70d0c5

          SHA512

          f26a9d3b8f0d0535cddaf466f38acc11b467004c1bfcc8f62b6c8788527fc0b0ec13e520ac5ed2e126dd188a87dce8c8b483dc2935c2000eb02a6c2a86294ba1

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
          Filesize

          400B

          MD5

          284fc732bdb20559b9c35f058d8b8575

          SHA1

          e3972d7c4917f8e71ae8772c36083cd1c9bde355

          SHA256

          85d7f6222a192764bc868b91c95003f5ba3b16f09edf88c78b77641a69465072

          SHA512

          dca4848be01f2260b1ff89b5e6560c21a4e705136e3e47b40fb798a9a96673cc94561d7640baf1073333423caa9bb0c5b450996aa9df99077c374343272d44c4

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\46ceb172-5bea1eda
          Filesize

          12KB

          MD5

          bde987640121265de7999403d95f247c

          SHA1

          545a717546e9005276997d4d5abe45b2291f87c4

          SHA256

          f9f4cded6b11ab6a76cdf90fc5ebdfecdc76fdbcdce6a77b4cfb8bfd03bb3eae

          SHA512

          60562db099fc331679d6ae5679133a41a08199900a9f2458fdcdd15fa5d079f155f6986082961dcb0387269494568db03f77dcd03c329c1c2d5d97348ab7ca83

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\46ceb172-5bea1eda.idx
          Filesize

          15KB

          MD5

          ec7e9558785835c21ab4a35221fc34e0

          SHA1

          106d4f524f17b4120cf05296978d8e5b04d9a315

          SHA256

          16133265407a4932761aa61ee38d3463d22e1b53c1405a83c02642e81ad4acb7

          SHA512

          8723f2c90e9f2ca841a472b3e46df8d236a618afde24b4d6fe1eb5e8f9b3ac1caf85a59c9c9413b6824a9e15c74f9459b13b4df9e9029f7f7dfeb2aa9fa71d96

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\security\blacklist.cache
          Filesize

          8KB

          MD5

          569fcf320b8fc65788b63811468d970b

          SHA1

          bdab122d0550ee2db31a2804e6662f2a98727b93

          SHA256

          f4df060ca35eb43e51774e76348dbd05c64b26df67576985ce99efccb3bfc6be

          SHA512

          c00b33b6dc2b944e6404f9cb2e42bd3dfc1658977405818d56805e86f390cef634740f743d559c8852d7ad6c3a02a71b2f5eb2064ef846647c99f82eaef54967

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
          Filesize

          685B

          MD5

          d1d996870c45624a9ec90327ad5480dd

          SHA1

          8e107b1542b337201ebec04c6de4178a0d51fc78

          SHA256

          b31f1bb288ab262d53fa524eb17efc10003cab162ec9eceb693391b108d27447

          SHA512

          4a615d43103d345aa33e74b15355c71a7fc012fd5e0bbe1b7105392069660544ca9699c19061e5b29be4aac72be579a0b813df6eb9d2b40e29278b86e8023b40

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\update.securitypack.timestamp
          Filesize

          1B

          MD5

          5058f1af8388633f609cadb75a75dc9d

          SHA1

          3a52ce780950d4d969792a2559cd519d7ee8c727

          SHA256

          cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

          SHA512

          0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\common[1]
          Filesize

          1KB

          MD5

          f5bb484d82e7842a602337e34d11a8f6

          SHA1

          09ea1dee4b7c969771e97991c8f5826de637716f

          SHA256

          219108bfef63f97562c4532681b03675c9e698c5ae495205853dbcbfd93faf1a

          SHA512

          a23cc05b94842e1f3a53c2ea8a0b78061649e0a97fcd51c8673b2bcb6de80162c841e9fdde212d3dfd453933df2362dcb237fe629f802bafaa144e33ca78b978

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\host[1]
          Filesize

          1KB

          MD5

          a752a4469ac0d91dd2cb1b766ba157de

          SHA1

          724ae6b6d6063306cc53b6ad07be6f88eaffbab3

          SHA256

          1e67043252582aea0e042f5a7be4a849b7cd01b133a489c3b2e67c10ade086f3

          SHA512

          abc2899705a23f15862acf3d407b700bb91c545722c02c7429745ab7f722507285c62614dcb87ea846f88fc0779345cb2e22dc3ad5f8113f6907821505be2c02

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\l10n[1]
          Filesize

          4KB

          MD5

          1fd5111b757493a27e697d57b351bb56

          SHA1

          9ca81a74fa5c960f4e8b3ad8a0e1ec9f55237711

          SHA256

          85bbec802e8624e7081abeae4f30bd98d9a9df6574bd01fe5251047e8fdaf59f

          SHA512

          80f532e4671d685fa8360ef47a09efcb3342bcfcf929170275465f9800bfbfffc35728a1ba496d4c04a1fdefb2776af02262c3774f83fea289585a5296d560b0

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\masthead_left[1]
          Filesize

          4KB

          MD5

          b663555027df2f807752987f002e52e7

          SHA1

          aef83d89f9c712a1cbf6f1cd98869822b73d08a6

          SHA256

          0ce32c034dfb7a635a7f6e8152666def16d860b6c631369013a0f34af9d17879

          SHA512

          b104ed3327fed172501c5aa990357b44e3b31bb75373fb8a4ea6470ee6a72e345c9dc4bcf46a1983c81adb567979e6e8e6517d943eb204c3f7fac559cd17c451

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\auwelcome_en[1]
          Filesize

          975B

          MD5

          89f6511366c1bcfee77d354fa17e6f75

          SHA1

          231e2ec9ca5873bdd3e2ff94947fe6342ff046e0

          SHA256

          d84f6975371b7b3f8b17e14a1eaf161d29504788355859e9513ae39c3cd8188e

          SHA512

          5bdc1414acc16d5f1d4d1f93d81d546740aa98143efcd9613eb0d53f9253bde65dc4d9ee20499a67c30a6f21bdc7165f006bbf2cf436a52967cd78262148f0b5

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\rtutils[1]
          Filesize

          244B

          MD5

          c0a4cebb2c15be8262bf11de37606e07

          SHA1

          cafc2ccb797df31eecd3ae7abd396567de8e736d

          SHA256

          7da9aa32aa10b69f34b9d3602a3b8a15eb7c03957512714392f12458726ac5f1

          SHA512

          cc68f4bc22601430a77258c1d7e18d6366b6bf8f707d31933698b2008092ba5348c33fa8b03e18c4c707abf20ce3cbcb755226dc6489d2b19833809c98a11c74

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\runtime[1]
          Filesize

          42KB

          MD5

          2d9448b2ba852451b1d1f944caad556f

          SHA1

          541701255e6993acfdc8f2e3200c46626d892a5b

          SHA256

          b4efa73754743314c21561de0c1038de174ec6507db34ac7f73fc5782034e7e1

          SHA512

          0c2d1cfd49c05d96f782f407e16fbe6128540ce084517fdec97567d06bdf92a6d7ec9b9531007a952e0c7a8742f4b6dd3bcfe070e39432298be74ebe5a6d4583

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\auwelcome[1]
          Filesize

          3KB

          MD5

          ad7c46157f8105f3f528c5059c2a637e

          SHA1

          7d469d240b974cc40a8e065d40dfbe856873f938

          SHA256

          0eba9547723a7cd3b508d044193762fe027703ed1a9de218c13a1a9ccd7aedab

          SHA512

          1adfcba6a56f1251e18c5384153c9b8d37c4d44972c242fa7391663904b0cd177058dc80020f1c8474e5a9df30d367df48fe80e382d88174a4405e07ba8afc7d

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\layout[1]
          Filesize

          2KB

          MD5

          cc86b13a186fa96dfc6480a8024d2275

          SHA1

          d892a7f06dc12a0f2996cc094e0730fe14caf51a

          SHA256

          fab91ced243da62ec1d938503fa989462374df470be38707fbf59f73715af058

          SHA512

          0e3e4c9755aa8377e00fc9998faab0cd839dfa9f88ce4f4a46d8b5aaf7a33e59e26dbf55e9e7d1f8ef325d43302c68c44216adb565913d30818c159a182120fc

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\masthead_fill[1]
          Filesize

          1KB

          MD5

          91a7b390315635f033459904671c196d

          SHA1

          b996e96492a01e1b26eb62c17212e19f22b865f3

          SHA256

          155d2a08198237a22ed23dbb6babbd87a0d4f96ffdc73e0119ab14e5dd3b7e00

          SHA512

          b3c8b6f86ecf45408ac6b6387ee2c1545115ba79771714c4dd4bbe98f41f7034eae0257ec43c880c2ee88c44e8fc48c775c5bb4fd48666a9a27a8f8ac6bcfdcb

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\au-descriptor-1.8.0_421-b09.xml
          Filesize

          6KB

          MD5

          ba3e9c5aa4fda91895a02570b482a3be

          SHA1

          922eb9468f8c6cf2f96cd42c8731483b713e8c00

          SHA256

          7ca95db3ca0412d8dfd8c8777fcde7cb14aab6a5b54b3c2f38f84c77c8831034

          SHA512

          8eb964d21d252dd86c8ac17be03c619e071c18e239d3a04c4d2df62ae9f02421dc0542ea5cf3ad4c0c5046dd7804c16a561e481008f0e8c2f3009e86611f6ca8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jar_cache6380895911386806990.tmp
          Filesize

          12KB

          MD5

          00e5f72258e6c602e6841bbf4c30b136

          SHA1

          52dbdf9eada5d7b0e015fd3523cca5cb915c23c2

          SHA256

          905a454fcb15e9f2a469a9a7e6e42b8c6425d20b33a59be5b84818daae964807

          SHA512

          50f0f286680fd33c29956455ca7e2d293402f369bd2e9079e45930853f1feb6e86208e1c8762d26dfc6f7e742044e912a4efded9a55ddfddaa454297cedc60c7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jusched.log
          Filesize

          3KB

          MD5

          cf06868a65f1a61e712806612ac9f3c7

          SHA1

          5ff8695819b953f6e12d45130d50054369789bfe

          SHA256

          f42713273b996ec1f46350ee87090bddfd4b4d5bd704eee5098f8b1cfb1bba63

          SHA512

          b3084a2299e28c68e09318cd3bb75ffcf3b6eda5425da1dfa44e4b9428b3f622de9882c6e4257630827d6e621bf9214a78094e244946947be9e5c703dc5224fe

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jusched.log
          Filesize

          8KB

          MD5

          d362aa8c41992c695a9036dbb827d51f

          SHA1

          7af588aa45140805a8c81b39f3ef708783a2dd60

          SHA256

          8a2858dbf7851b740bf7e68d8551d4af306a75a6564be390ed2ccdd649cc1712

          SHA512

          869d792c17ada7c5fb7d0fb2932bf4598f61c1e3d4a83d2ecef163169584dd49488bf01ab76d00407e75a9d905fb94ddae6392cb88f0d8b62e7c086205e43d5e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\jusched.log
          Filesize

          30KB

          MD5

          5b0e5c6565598df94ea9796cc1b999d1

          SHA1

          d4796ade73df54a127e28ed33a19a977ea0648b3

          SHA256

          4eec161254cdd6428ebc0cc1d8f66006127d838467be2efebcd4b2d21c84db3b

          SHA512

          e75cb0eff599160779bbe158e2623f94926489ddeae016587058105f30d086167b479531e3bdf25d1dd58f4e780c4421f5a04059366ed3ea202cb1a329ebb054

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\83aa4cc77f591dfc2374580bbd95f6ba_5a410d66-f84f-4a6b-9b29-3982febe58d9
          Filesize

          45B

          MD5

          c8366ae350e7019aefc9d1e6e6a498c6

          SHA1

          5731d8a3e6568a5f2dfbbc87e3db9637df280b61

          SHA256

          11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

          SHA512

          33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

          Download Submit

        • \Users\Admin\AppData\Local\Temp\8DBF.tmp
          Filesize

          145KB

          MD5

          c610e7ccd6859872c585b2a85d7dc992

          SHA1

          362b3d4b72e3add687c209c79b500b7c6a246d46

          SHA256

          14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

          SHA512

          8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

          Download Submit

        • memory/2432-0-0x00000000003B0000-0x00000000003FC000-memory.dmp

          Filesize

          304KB

          Download

        • memory/2704-254-0x0000000000330000-0x0000000000331000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2704-52-0x0000000002A90000-0x0000000002D00000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/2704-220-0x0000000000330000-0x0000000000331000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2704-47-0x0000000000310000-0x000000000031A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2704-48-0x0000000000310000-0x000000000031A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2704-229-0x0000000000330000-0x0000000000331000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2704-305-0x0000000002A90000-0x0000000002D00000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/2704-296-0x0000000000330000-0x0000000000331000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2704-302-0x0000000000330000-0x0000000000331000-memory.dmp

          Filesize

          4KB

          Download