2253320a3a18026f312a4a387fb41787e3ce525b52496c39552ba19b04c8708d

Resubmissions

02/10/2024, 15:58

241002-teqmlsvdkm 5

02/10/2024, 15:57

241002-tedcaavcrn 5

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Firefox Installer.exe
Size

363KB
MD5

8e9cfdeb626b59cff3714e7b7a70b784
SHA1

23ad0734b40ddbf12360b41bf06caec354c9e012
SHA256

2253320a3a18026f312a4a387fb41787e3ce525b52496c39552ba19b04c8708d
SHA512

8a7684168d4ae996b1c30fc96a06376dad4c02a72cadea52f8f841821b1c36f01399302ee1c7b684f7a7aed90a0bbcd61bc8ae6916bab15f6e1d21448762f5b7
SSDEEP

6144:7aVWdyzOxeA1DfdwX3MmIOgWqbI52i3cxXl0RLWURVxI+N1mtWqMVmfeCUg4EIg:7MROxdDfOnMmXP0TcRZJjmooxIg

Score

5^/10

discovery spyware stealer upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4288-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx
behavioral2/memory/4288-77-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nsz9D6D.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsz9D6E.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsz9D6D.tmp\	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsj9D5B.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsz9D6C.tmp	setup-stub.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nsj9D5B.tmp\	setup-stub.exe

Executes dropped EXE 1 IoCs

pid	Process
2752	setup-stub.exe

Loads dropped DLL 7 IoCs

pid	Process
2752	setup-stub.exe
2752	setup-stub.exe
2752	setup-stub.exe
2752	setup-stub.exe
2752	setup-stub.exe
2752	setup-stub.exe
2752	setup-stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	2752	WerFault.exe	82

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Firefox Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup-stub.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	setup-stub.exe
2752	setup-stub.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 2752	4288	Firefox Installer.exe	82
PID 4288 wrote to memory of 2752	4288	Firefox Installer.exe	82
PID 4288 wrote to memory of 2752	4288	Firefox Installer.exe	82

C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Firefox Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\7zS0C02ADA7\setup-stub.exe
  .\setup-stub.exe
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 2512
    3⤵
    - Program crash
    PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2752 -ip 2752
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS0C02ADA7\setup-stub.exe

Filesize
630KB

MD5
f117097319c87871100225bc370f7ad4

SHA1
d3e287b9abce80dda371b42c7b8f84417c5c2b13

SHA256
880684fa0ecbcfbe43d84dccb68a2904329ff6cab7723ad8f9b33dbeef35af33

SHA512
d6c04a4b144a0521618ac8658e29a5e8293b0372a82e2fc42f47679a93f89074d55d24ade8706271769a8abb9b954ff0a734407e81a1d2471d91fe0c525163d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\CityHash.dll

Filesize
53KB

MD5
2021acc65fa998daa98131e20c4605be

SHA1
2e8407cfe3b1a9d839ea391cfc423e8df8d8a390

SHA256
c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14

SHA512
cb96d3547bab778cbe94076be6765ed2ae07e183e4888d6c380f240b8c6708662a3b2b6b2294e38c48bc91bf2cc5fc7cfcd3afe63775151ba2fe34b06ce38948

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\InetBgDL.dll

Filesize
95KB

MD5
af9e2d138cf17b8ff4d4b8df7fddaefa

SHA1
539afa302bc5cae7022896048cb7a0f3f2ab6907

SHA256
3921dec014fadd1de7f3a36606ac95882a17cb96df38a5424e58531a169f825b

SHA512
631ad8bbb9eea42b230f2729714874c921677c4be91ac0b35ab9e7751613045eb249f8a0dd1d5ce06bf2cd544507795836dcbf42be79f01a71333570ea27c840

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\System.dll

Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\UAC.dll

Filesize
28KB

MD5
d23b256e9c12fe37d984bae5017c5f8c

SHA1
fd698b58a563816b2260bbc50d7f864b33523121

SHA256
ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c

SHA512
13f284821324ffaeadafd3651f64d896186f47cf9a68735642cf37b37de777dba197067fbccd3a7411b5dc7976e510439253bd24c9be1d36c0a59d924c17ae8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\UserInfo.dll

Filesize
14KB

MD5
610ad03dec634768cd91c7ed79672d67

SHA1
dc8099d476e2b324c09db95059ec5fd3febe1e1e

SHA256
c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df

SHA512
18c3c92be81aadfa73884fe3bdf1fce96ccfbd35057600ef52788a871de293b64f677351ba2885c6e9ce5c3890c22471c92832ffc13ba544e9d0b347c5d33bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\WebBrowser.dll

Filesize
103KB

MD5
b53cd4ad8562a11f3f7c7890a09df27a

SHA1
db66b94670d47c7ee436c2a5481110ed4f013a48

SHA256
281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec

SHA512
bb45d93ed13df24a2056040c219cdf36ee44c8cddb7e178fdaabcec63ac965e07f679ca1fa42591bba571992af619aa1dc76e819a7901709df79598a2b0cef81

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\profile_cleanup.html

Filesize
1KB

MD5
1cb97b5f8c5f2728b26742d1d0669899

SHA1
bb5ab1b8c00810fcb18184a996573c5accdc72c3

SHA256
dec82e9caa154300e1aa44f550c16b455a2025be4fb1c3155cb75fe04a6b6611

SHA512
768ed2b070485f3bbcf457aefdc0ef8f1737ad8ac4a2703e2feaff424f9a2c69a2f5928a3be898932ef4976a44ea829a099d090bd9941a24d045d5c8ac8b7b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\profile_cleanup.js

Filesize
1KB

MD5
d845e8f4c0edb3cab17e6a30090ac5b8

SHA1
654f058570f0868f0acc5f0595147f3385a9c265

SHA256
1adcfdd9768242c6c639b10e4f0bcda24f6a957a169c1dede265e40336ecbd4f

SHA512
401d800c484b74401b90c3285d8b6cc0018baf4979d6ec7bb174f7810d3f60adfa6b4cebeafcee20d5a7c3597447f755af19c5fecf1863e2438fe427dbdf9fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso9D2B.tmp\stub_common.js

Filesize
815B

MD5
efce3dce0165b3f6551db47e5c0ac8d6

SHA1
1e15f6bb688e3d645092c1aa5ee3136f8de65312

SHA256
dab39cbae31848cce0b5c43fddd2674fef4dea5b7a3dacdaabdc78a8a931817e

SHA512
cec12da07f52822aaed340b1b751153efa43e5c3d747fa39f03bb2800bf53e9416020d654a818a6088acb2cf5581714433d818537f04af150e6bfb6861c03988

Download Submit
memory/4288-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4288-77-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download