Overview
overview
7Static
static
5malware.exe
windows7-x64
3malware.exe
windows10-2004-x64
3malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
5malware.exe
windows10-2004-x64
5malware.exe
windows7-x64
3malware.exe
windows10-2004-x64
3malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
7malware.exe
windows7-x64
7malware.exe
windows10-2004-x64
5Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 08:58
Behavioral task
behavioral1
Sample
malware.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
malware.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
malware.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
malware.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
malware.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
malware.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
malware.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
malware.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
malware.exe
Resource
win7-20240903-en
General
-
Target
malware.exe
-
Size
80KB
-
MD5
0f37839f48f7fc77e6d50e14657fb96e
-
SHA1
35698c61ad232ff90c5812372d23971118ea37cd
-
SHA256
f097ad77b99b3744994a646d6a3577cea2faa8b9e656fcccbbd73244e227c850
-
SHA512
72bf97c978cd4319198ac5a379d224ddc90e471251e9d817a2fe9ab362cbaab9f5f6647f2261689ddd8f340cce04e602e38faf907ac543ee5d4ad7ef23e3cbd5
-
SSDEEP
1536:CtX20yVt4dA3bfyF6FwfxQ8WPmNgPez/FpaWD0i2CVyPBQcc0WYQirQ9Z:eZ0u6LBqJdWPdPezTmiRmiQ8irQH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3016 cleansweep.exe -
Loads dropped DLL 2 IoCs
pid Process 1684 malware.exe 1684 malware.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language malware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cleansweep.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1684 malware.exe 1684 malware.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe 3016 cleansweep.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1684 malware.exe Token: SeDebugPrivilege 1684 malware.exe Token: SeDebugPrivilege 3016 cleansweep.exe Token: SeDebugPrivilege 3016 cleansweep.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 1200 1684 malware.exe 21 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 384 1684 malware.exe 3 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5 PID 1684 wrote to memory of 432 1684 malware.exe 5
Processes
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1624
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:824
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1164
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:976
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:268
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:352
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1072
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1120
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2116
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2996
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\malware.exe"C:\Users\Admin\AppData\Local\Temp\malware.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\cleansweep.exe\cleansweep.exe"C:\cleansweep.exe\cleansweep.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
279B
MD52c4c2e4cc5999e5902c534618cd6b349
SHA13af95b9672e85ea2fc6d38e65b6270a4af40a773
SHA256fd42953765337532984a0a760460fd9c2d36a473ada38eca0bbf13eb8309d745
SHA5129006b5f41b34d411ba47ffedf658c41dbb3e1374cc5dcccbc18c70c54b8f08e8b70d1f60d05e40ff7a9b2741aaa86de72a219df9eed521b8f93a9ee1c40b13e1
-
Filesize
80KB
MD50f37839f48f7fc77e6d50e14657fb96e
SHA135698c61ad232ff90c5812372d23971118ea37cd
SHA256f097ad77b99b3744994a646d6a3577cea2faa8b9e656fcccbbd73244e227c850
SHA51272bf97c978cd4319198ac5a379d224ddc90e471251e9d817a2fe9ab362cbaab9f5f6647f2261689ddd8f340cce04e602e38faf907ac543ee5d4ad7ef23e3cbd5