Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 22:10
Static task
static1
Behavioral task
behavioral1
Sample
27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe
Resource
win10v2004-20240802-en
General
-
Target
27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe
-
Size
326KB
-
MD5
adcbb5fa5706fb287f01370eb99e0d10
-
SHA1
2bff6fd096b95b1591259d223f7a0ced2bb1c79f
-
SHA256
27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700
-
SHA512
c2c9addbbbad6c678069874428ab54060550e583e018af9052a8445ee32bfb72586592711b6ae25d392378e50fdfb2ff9a6741d4aa4a5b15cd0b16176db0b8f1
-
SSDEEP
6144:Ns/IeaQRgAaVIEs1gsHKyDbrXtkD+yEl9WsAwT92ORxEO:qweRd11d5frdhyEl9WiT93EO
Malware Config
Extracted
stealc
default
http://46.8.231.109
-
url_path
/c4754d4f680ead72.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2868 set thread context of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 2348 2156 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2868 wrote to memory of 2156 2868 27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe 29 PID 2156 wrote to memory of 2348 2156 RegAsm.exe 30 PID 2156 wrote to memory of 2348 2156 RegAsm.exe 30 PID 2156 wrote to memory of 2348 2156 RegAsm.exe 30 PID 2156 wrote to memory of 2348 2156 RegAsm.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe"C:\Users\Admin\AppData\Local\Temp\27055280296d10b811b4d76456dbc5d29aac8b4fc33708fa47b36334e1d85700N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 2523⤵
- Program crash
PID:2348
-
-