Analysis
-
max time kernel
146s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe
Resource
win7-20240729-en
General
-
Target
cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe
-
Size
9.5MB
-
MD5
00f86418396c17d89d43328753aa0e94
-
SHA1
535724a5b79937c3241e59460cf8f0b461625b22
-
SHA256
cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38
-
SHA512
5e3d6e058c0a7d78581c0c354b2d43d755afa3fdb25d5e308816e0a336f945e4b6d59a3cbea9a790f45c4ce516c6caf698400e1695a3a51fab4343ead9738c28
-
SSDEEP
49152:5VpdkTXbGT7Zx6BhJ+exaueO63nsk0MEwJZpxm2TfP77LIYoMRBW:5pkLbGP/6fJ+
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2908 service123.exe 2232 service123.exe 772 service123.exe -
Loads dropped DLL 5 IoCs
pid Process 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 2908 service123.exe 2232 service123.exe 772 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2692 schtasks.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2908 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 30 PID 2216 wrote to memory of 2908 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 30 PID 2216 wrote to memory of 2908 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 30 PID 2216 wrote to memory of 2908 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 30 PID 2216 wrote to memory of 2692 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 31 PID 2216 wrote to memory of 2692 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 31 PID 2216 wrote to memory of 2692 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 31 PID 2216 wrote to memory of 2692 2216 cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe 31 PID 1728 wrote to memory of 2232 1728 taskeng.exe 34 PID 1728 wrote to memory of 2232 1728 taskeng.exe 34 PID 1728 wrote to memory of 2232 1728 taskeng.exe 34 PID 1728 wrote to memory of 2232 1728 taskeng.exe 34 PID 1728 wrote to memory of 772 1728 taskeng.exe 36 PID 1728 wrote to memory of 772 1728 taskeng.exe 36 PID 1728 wrote to memory of 772 1728 taskeng.exe 36 PID 1728 wrote to memory of 772 1728 taskeng.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe"C:\Users\Admin\AppData\Local\Temp\cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2692
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {118E3E4F-E269-4F2F-A2BC-790E01236964} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772
-