cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe

Analysis

max time kernel
25s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe
Size

272KB
MD5

fcddcc6103abdc8512e6aef6a41944a0
SHA1

102acf317f50f0d45dc93f804e20ec8c7ab3a151
SHA256

cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe
SHA512

709786c78d44ea9e71d93beb8c09ca3d6225eac03434d5642bb42864f1d366056429806b6aae5f65e4766710cfaed5dafdfa8ee9fe2ed487738db44d7fc55e1c
SSDEEP

6144:ijOZOz0jOZ+ghfu3WujOZsfRYDjbvKT8N5XaMLPOgRv+qR:ijOZOz0jOZ+g1umujOZsCq8NNPl9+q

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2784	Install Lightroom 2.4.exe
2936	server.exe
2552	Install Lightroom 2.4.exe
2664	server.exe

Loads dropped DLL 11 IoCs

pid	Process
880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe
880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe
880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe
2784	Install Lightroom 2.4.exe
2784	Install Lightroom 2.4.exe
2784	Install Lightroom 2.4.exe
2784	Install Lightroom 2.4.exe
2936	server.exe
2552	Install Lightroom 2.4.exe
2552	Install Lightroom 2.4.exe
2552	Install Lightroom 2.4.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 2552	2784	Install Lightroom 2.4.exe	32
PID 2936 set thread context of 2664	2936	server.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install Lightroom 2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install Lightroom 2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2388	timeout.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2784	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	30
PID 880 wrote to memory of 2936	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	31
PID 880 wrote to memory of 2936	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	31
PID 880 wrote to memory of 2936	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	31
PID 880 wrote to memory of 2936	880	cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe	31
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2784 wrote to memory of 2552	2784	Install Lightroom 2.4.exe	32
PID 2936 wrote to memory of 2664	2936	server.exe	33
PID 2936 wrote to memory of 2664	2936	server.exe	33
PID 2936 wrote to memory of 2664	2936	server.exe	33
PID 2936 wrote to memory of 2664	2936	server.exe	33
PID 2936 wrote to memory of 2664	2936	server.exe	33
PID 2936 wrote to memory of 2664	2936	server.exe	33
PID 2664 wrote to memory of 2852	2664	server.exe	34
PID 2664 wrote to memory of 2852	2664	server.exe	34
PID 2664 wrote to memory of 2852	2664	server.exe	34
PID 2664 wrote to memory of 2852	2664	server.exe	34
PID 2852 wrote to memory of 2388	2852	cmd.exe	36
PID 2852 wrote to memory of 2388	2852	cmd.exe	36
PID 2852 wrote to memory of 2388	2852	cmd.exe	36
PID 2852 wrote to memory of 2388	2852	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe
"C:\Users\Admin\AppData\Local\Temp\cf1e0e2019d7b2a1535c3ac8e6de29fcea80e690116d0f6f2ac50205277086fe.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\Install Lightroom 2.4.exe
  "C:\Users\Admin\AppData\Local\Temp\Install Lightroom 2.4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\Install Lightroom 2.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Install Lightroom 2.4.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2552
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\server.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Install Lightroom 2.4.exe

Filesize
98KB

MD5
a60ca61e6d68432e67df805e3993acab

SHA1
9329198e5fac53f8c23af8c740d02fb3be1c8c89

SHA256
8f260601b2f89584dd665f91ac3222dd99fa9ce7d7ba912288a5a96f6474193e

SHA512
095e3e3153224508172d87a32d7e8b679a04abbbfd6c5f3244989d484a786e22f502440707a928d26816fd2ec616ac669ea5e0ec0416aefe36c9ea23fe5db87a

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
138KB

MD5
49b46e6f0e2d9aea8dd2ad7d635fbb1d

SHA1
7820e7d24e0f51f3b0bcf67a1d2a7cbfd81d9e9e

SHA256
6777656fef03083dad8c649997df0db87bd0f4250a144edb28c5938e474b5c9b

SHA512
c4a9ff64b6e20bee7b3fe8bb6bb05ea8cd90147d45f04d486ddf27d6f1176d5f0b45799c37212bd3d14589867ed25639e0e84d33734e819c722b47e8552033d9

Download Submit
memory/2552-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2552-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2664-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-35-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download