98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe
Size

548KB
MD5

0030904d914a90d527d3818bd751c8c0
SHA1

3bf2dfc0bd03f771bbeac90ff52b0949dd866f7f
SHA256

98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4
SHA512

647b028bc5d669ce570a51a45b83ae2ba3c4491eb2d8f675fa6cc94f4f4036f9232e6e86b97820cce2eaeab584fe551b29baa4aeee516c49a1ff03f8f199ae98
SSDEEP

12288:LS6yXhEVas0gONJIhNoKbgSzf9+ga7OiPrhyaiDa:GBDf8AJS5+d/PrhTiDa

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2432	1724	98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe	82
PID 1724 wrote to memory of 2432	1724	98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe	82
PID 1724 wrote to memory of 2432	1724	98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe	82

C:\Users\Admin\AppData\Local\Temp\98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe
"C:\Users\Admin\AppData\Local\Temp\98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\984.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\803616.exe

Filesize
548KB

MD5
0030904d914a90d527d3818bd751c8c0

SHA1
3bf2dfc0bd03f771bbeac90ff52b0949dd866f7f

SHA256
98c19ac301e6eac6e7897647e02c67960167eacc38016650cab8361942cb06b4

SHA512
647b028bc5d669ce570a51a45b83ae2ba3c4491eb2d8f675fa6cc94f4f4036f9232e6e86b97820cce2eaeab584fe551b29baa4aeee516c49a1ff03f8f199ae98

Download Submit
C:\Users\Admin\AppData\Local\Temp\984.bat

Filesize
177B

MD5
fca3cb60f30e44a034dd1deb3c0b1deb

SHA1
d7a110245be7e70a54b7b3adbb7913738d419a76

SHA256
cf27dd1388a660f1190490ee182f6383f54417a79a28582e78c8e888023cc3ef

SHA512
abb4cd34f5b8d64a9689650b169e7ea1d9e85ce1693d52e2e71a358eb6fab63cac28ab3649d21cfa3571370c57aec5695b6de09290be4889090a0e90ae8bf939

Download Submit
memory/1724-0-0x00000000049E0000-0x0000000004B14000-memory.dmp

Filesize
1.2MB

Download