Analysis
-
max time kernel
140s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 19:24
General
-
Target
1cd55f55844375499f19a7a88f0e61eb2662720f05d9e9397cb205bc0a15c9e4.exe
-
Size
915KB
-
MD5
fa4a49ff0acd3652ec97a23cf2026331
-
SHA1
8c168f4efa3b3fadaa6d7b64dada8424ffcb45d3
-
SHA256
1cd55f55844375499f19a7a88f0e61eb2662720f05d9e9397cb205bc0a15c9e4
-
SHA512
95dbe72ea0144f5e4d1fd240811487a2c40b3365738758301485e7a91c0f8ea54387e0e77d690a1386dc4c1084d3814bdc4624be06ee29b32575733b60c292cc
-
SSDEEP
24576:zynTm5wm55BcL/o59eSaxupKurTH1b0OTf:z/ibo58iZrTVb0of
Malware Config
Signatures
-
Detected Nirsoft tools 27 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView 26 IoCs
Password recovery tool for various email clients
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cd55f55844375499f19a7a88f0e61eb2662720f05d9e9397cb205bc0a15c9e4.exe"C:\Users\Admin\AppData\Local\Temp\1cd55f55844375499f19a7a88f0e61eb2662720f05d9e9397cb205bc0a15c9e4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8D8A.exe"C:\Users\Admin\AppData\Local\Temp\8D8A.exe" /stab "C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\9173.exe"C:\Users\Admin\AppData\Local\Temp\9173.exe" /stab "C:\Users\Admin\AppData\Local\Temp\9173.tmp" /no_pass_cred2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5c2823f56d69cb70849fecf234c767b61
SHA113b05525cc52ab396ed046e5326ad36bbe8e0d95
SHA2568f20fb47434eba365a366e5e507e43012aa09c71d36d92a846e1d1e4729a26dc
SHA512b091c33a19c63c1da7b43322eb535a6c455e40e16601b73449f5a9563280ea0d31eb814368af45b169b7de75fbb55a22edacac383fdfa893e40bdbd5e2632724
-
Filesize
48KB
MD5045585e0b15eef92c44dd4ee86d51c8c
SHA13fc0961946706ddb3538ef89dd9eb42a8ac9da4c
SHA256481ddfd994085f7fa40e92369e0fca2bdde198ffacdb5138b4de2e6ef0a6aab4
SHA512b5d8f889327d01f7ec348bb3303592f271b289f585fc591953493f05f8ca2ed6f9e83d1018c38df8bb9998bb9ee19b6fb78c8a01e370e8dd32895ded34b94b3a
-
Filesize
186B
MD5762c597cbf0458242b32a770b29830ab
SHA1079c64621c88414e9e59239eec0c789c0071dd68
SHA256efacaa084e12cf26bc25ad83742b6ae9b1df4a537f13df802563af2270462cd4
SHA512c0c4edc550b8f1fc36ef74b233b0e85a3669cb913057b4854d99d517554b6a8d17201938e7c3225eb6c87e9eb3277c9044f0013f28bd27bd644ee8fd5802d661
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
952KB
-
Filesize
928KB
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
952KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
4KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
928KB