Resubmissions

15-09-2024 23:12

240915-27aqvsxhjq 8

15-09-2024 23:02

240915-21efgaxake 8

15-09-2024 22:58

240915-2xypyaxdkj 3

15-09-2024 22:56

240915-2wn44sxcpk 3

15-09-2024 22:43

240915-2np2fawhpr 3

15-09-2024 22:42

240915-2m3k5swhmk 10

15-09-2024 22:33

240915-2gqdmawbja 8

15-09-2024 22:27

240915-2de4gswekk 7

15-09-2024 22:15

240915-16esravenh 10

Analysis

  • max time kernel
    1200s
  • max time network
    838s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 22:15

General

  • Target

    eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/Security Central/[email protected]

  • Size

    904KB

  • MD5

    0315c3149c7dc1d865dc5a89043d870d

  • SHA1

    f74546dda99891ca688416b1a61c9637b3794108

  • SHA256

    90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

  • SHA512

    7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

  • SSDEEP

    24576:bnQv6Dyxn2Qx0KHizHWKxHuyCcZFyXR1tG:2OE2QtCzhh/7R

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 63 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 30 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Central\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Central\[email protected]"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Central\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\Security Central\[email protected]"
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2396
      • C:\Program Files (x86)\Security Central\Security Central.exe
        "C:\Program Files (x86)\Security Central\Security Central.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Program Files (x86)\Security Central\Security Central.exe
          "C:\Program Files (x86)\Security Central\Security Central.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2684
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x258
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Security Central\Security Central.exe

    Filesize

    904KB

    MD5

    0315c3149c7dc1d865dc5a89043d870d

    SHA1

    f74546dda99891ca688416b1a61c9637b3794108

    SHA256

    90c2c3944fa8933eefc699cf590ed836086deb31ee56ec71b5651fd978a352c9

    SHA512

    7168dc244f0e400fa302801078e3faec8cdd2d3cb3b8baaab0a1b3c0929d7cf41e54bfbe530ad5ce96a6b63761f7866d26aaae788c3138c34294174091478112

  • memory/2396-2-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2396-7-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2396-6-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2396-5-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2396-8-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2396-25-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-22-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-26-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-28-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-27-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-35-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-36-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-37-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-38-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-40-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-41-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-42-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-43-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-44-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-45-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-46-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-47-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-48-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-49-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-50-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-51-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-52-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-53-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-54-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-55-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-56-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-57-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-58-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-59-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-60-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-61-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-62-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-63-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-64-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-65-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-66-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-67-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-68-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-69-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-70-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-71-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-72-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-73-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-74-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-75-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-76-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-77-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-78-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-79-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-80-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-81-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-82-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-83-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-84-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-85-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-86-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-87-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB

  • memory/2684-88-0x0000000000400000-0x0000000000A35000-memory.dmp

    Filesize

    6.2MB