Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 16:16
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
3.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
4.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
4.exe
Resource
win10v2004-20240802-en
General
-
Target
2.exe
-
Size
13.2MB
-
MD5
8858afdac61eeb17682db20888963df4
-
SHA1
501d62787335daf5f7ee678c03ad7815a8a69b2c
-
SHA256
b0649ae8468c315c2d8bbc2a879cc7162360660402487105761632c7342dd861
-
SHA512
96ee49acff2423b6c1af9eb3e4142740b7a1b10c5a5800206d44af75f4ac7e666fc1693b5e84f9913ceb567dfcd97db995a6f737a6674fe14308028c76d9e2e3
-
SSDEEP
196608:y/nc6X0YjOtzpNRR1WzyP06rmWjymKIn99NMc2mX3W:y/nc6X0YjOtzpNP1WbWea3McNXm
Malware Config
Extracted
stealc
mainteam
http://95.182.96.50
-
url_path
/2aced82320799c96.php
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Downloads MZ/PE file
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
2.exepid process 2668 2.exe 2668 2.exe 2668 2.exe