Resubmissions

26-09-2024 13:53

240926-q6358szhjn 10

18-09-2024 09:53

240918-lwmnaavaje 9

Analysis

  • max time kernel
    94s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2024 09:53

General

  • Target

    3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437.exe

  • Size

    76KB

  • MD5

    7a47db5c25aaae2b0772c78f70983681

  • SHA1

    d9994e6210e4ba1eaf210a43453143ed8011ef87

  • SHA256

    3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437

  • SHA512

    8c114069e1d207c86a299fcbb3120c1d22e70a9233ab05a9faf5c1dbd15cf293e54241b2a710241791942ee9ee7f46729d8d4f54ba4ac634b54b3ec7c8ddbd32

  • SSDEEP

    1536:AdRlBEByBQBFDz+oBLBvOBSBlB+2xq0uEYqLIm08TIVVtDKsh6:QlBEByBQBdz+oBLBGBSBlBRxq09FvfTX

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437.exe
    "C:\Users\Admin\AppData\Local\Temp\3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:3956
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:3168
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2004
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show profile
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:1960
      • C:\Windows\SysWOW64\findstr.exe
        findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2216
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3956-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

  • memory/3956-1-0x00000000009B0000-0x00000000009CA000-memory.dmp

    Filesize

    104KB

  • memory/3956-2-0x0000000074A80000-0x0000000075230000-memory.dmp

    Filesize

    7.7MB

  • memory/3956-3-0x0000000005B70000-0x0000000005C56000-memory.dmp

    Filesize

    920KB

  • memory/3956-4-0x0000000005DE0000-0x0000000005E46000-memory.dmp

    Filesize

    408KB

  • memory/3956-5-0x0000000006630000-0x0000000006642000-memory.dmp

    Filesize

    72KB

  • memory/3956-6-0x0000000006BA0000-0x0000000006D62000-memory.dmp

    Filesize

    1.8MB

  • memory/3956-30-0x0000000007370000-0x0000000007914000-memory.dmp

    Filesize

    5.6MB

  • memory/3956-37-0x0000000006E40000-0x0000000006EB6000-memory.dmp

    Filesize

    472KB

  • memory/3956-38-0x0000000006F60000-0x0000000006FF2000-memory.dmp

    Filesize

    584KB

  • memory/3956-60-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

  • memory/3956-61-0x0000000074A80000-0x0000000075230000-memory.dmp

    Filesize

    7.7MB

  • memory/3956-62-0x0000000007E50000-0x000000000837C000-memory.dmp

    Filesize

    5.2MB

  • memory/3956-64-0x0000000074A80000-0x0000000075230000-memory.dmp

    Filesize

    7.7MB