Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2024 21:04

General

  • Target

    123.exe

  • Size

    8.2MB

  • MD5

    f675e62581b09ecb840416233c8460bc

  • SHA1

    b7a42ed4a3f13d13905d910f02147d8bdc040b2b

  • SHA256

    b4fed30b7d5c533ae1a553607630badbdc10aeacb612ff996e919d014bc2313c

  • SHA512

    3bebe82737757c606356cab8877aa7ece5304f7eebbff1695bc4f20502e981d9ce4551ad3492f7c5580bd06d94cd63cd70a8706d24e73ae52e55e38f0f9b9a8a

  • SSDEEP

    196608:ZEI9eJx7jQ/b7NuD4VuRS79tcM6vJKjJQQcrgUEr0NFMx3BWhp6D:ZEI9eXQ/b7NuD4VuRS79tczvJJQcrPEL

Malware Config

Extracted

Family

stealc

Botnet

benjiworld9

C2

http://5.188.86.71

Attributes
  • url_path

    /05feb00efef399f8.php

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

  • Stealc

    Stealc is an infostealer written in C++.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1476
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\486d3656

    Filesize

    909KB

    MD5

    0dadc961ffd455eaf2545c2e529d0b36

    SHA1

    dd7d6de275988985b495eb283d53274014c78ad9

    SHA256

    2aa9ecf4c642533cbf9161f5fe199af8335f686d442fd47785993f26dd541821

    SHA512

    f26b09584e2995bbb7cbdaacfe4b4ea8b039a81c5a6b4711252f84f9d619134e2cd41aa6263306f0138ec539d101f79bc8875bd74907f5c88131fa10c7bc7397

  • memory/1476-19-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/1476-17-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/1476-16-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/1476-15-0x00007FFBB8270000-0x00007FFBB8465000-memory.dmp

    Filesize

    2.0MB

  • memory/1476-12-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/1920-26-0x00000000002F0000-0x0000000000535000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-24-0x0000000000CD3000-0x0000000000CDB000-memory.dmp

    Filesize

    32KB

  • memory/1920-25-0x0000000000BF0000-0x0000000001023000-memory.dmp

    Filesize

    4.2MB

  • memory/1920-22-0x00000000002F0000-0x0000000000535000-memory.dmp

    Filesize

    2.3MB

  • memory/1920-21-0x00007FFBB8270000-0x00007FFBB8465000-memory.dmp

    Filesize

    2.0MB

  • memory/1920-20-0x00000000002F0000-0x0000000000535000-memory.dmp

    Filesize

    2.3MB

  • memory/5056-7-0x0000000073D83000-0x0000000073D85000-memory.dmp

    Filesize

    8KB

  • memory/5056-4-0x0000000073D83000-0x0000000073D85000-memory.dmp

    Filesize

    8KB

  • memory/5056-5-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/5056-0-0x0000000004450000-0x0000000004451000-memory.dmp

    Filesize

    4KB

  • memory/5056-3-0x00007FFBB8270000-0x00007FFBB8465000-memory.dmp

    Filesize

    2.0MB

  • memory/5056-10-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/5056-8-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/5056-2-0x0000000073D70000-0x0000000073EEB000-memory.dmp

    Filesize

    1.5MB

  • memory/5056-6-0x0000000004450000-0x0000000004451000-memory.dmp

    Filesize

    4KB

  • memory/5056-1-0x0000000000400000-0x0000000000C48000-memory.dmp

    Filesize

    8.3MB