Overview

overview

7

Static

static

3

8c79c7aa2e...2N.exe

windows7-x64

7

8c79c7aa2e...2N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 17:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8c79c7aa2e0760e01e856d5800eabfeb2e6f5c283f3baad84f44132d98477022N.exe

  • Size

    330KB

  • MD5

    33216aa4fb16f8942a4e7521e7fb5840

  • SHA1

    054ec5b0ed6e36b4ef53e730f2f6d3fbfff64834

  • SHA256

    8c79c7aa2e0760e01e856d5800eabfeb2e6f5c283f3baad84f44132d98477022

  • SHA512

    ba0ad05cfe02d6144c02594c39c3aacc1ee8dc4375f496808209d72a70cdbeb11a10c4403b2c9d2ba9f00ca328103775d6f67b5837d65dac938f3f1642486cf6

  • SSDEEP

    6144:GjYKlAhUBVB3pQO3uhU6YTFjVxG/DG/FczgfkkyxPDRgVMYKuLCZnf9I:GjYRm7QO3s1YTF5wC/WYkDgWKmZnf9I

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c79c7aa2e0760e01e856d5800eabfeb2e6f5c283f3baad84f44132d98477022N.exe
    "C:\Users\Admin\AppData\Local\Temp\8c79c7aa2e0760e01e856d5800eabfeb2e6f5c283f3baad84f44132d98477022N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\iOKfGUmy50NNoHC.exe
    Filesize

    243KB

    MD5

    d1eb6d1548034f0a5ff95bada0db4740

    SHA1

    0a204e6ca1beb3ed41e7c2d7718978a56dc0a8ba

    SHA256

    0741bd08d2b3401b122d17f43af436fad3c644cb2ff493e28b385415b3eb6b6f

    SHA512

    a97987824df779e39c76502bcdc686b74493360e9abf4e9e3da2b08d2ad69869d59516b2b1c934b6703145547d078a4fa6732cb810aba0a05a37793eecea67e5

    Download Submit

  • C:\Windows\CTS.exe
    Filesize

    86KB

    MD5

    0f736d30fbdaebed364c4cd9f084e500

    SHA1

    d7e96b736463af4b3edacd5cc5525cb70c593334

    SHA256

    431b7f30b7f8d520f69066b03b8dccbb35a6cb40a53c5e2320c6b5acf96b2e34

    SHA512

    570a2f76d653414fedc12ed486f2bf0333dc860f52d70faa895d6b9951ac185317637d7b076e05c932f4c536259e19a952a716e9516d506d2a19de73c50f2566

    Download Submit