Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
cartao.petrobras.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cartao.petrobras.exe
Resource
win10v2004-20241007-en
General
-
Target
cartao.petrobras.exe
-
Size
192KB
-
MD5
e3eb71da07cd6a45b9797a72069c42f2
-
SHA1
3cdc77312b3aff2bbe97ff344a7d64ed02cb9a23
-
SHA256
59219bd48028cc39af0e10eb3aa7162263ea9fa1d2347a781f79508482fef5ef
-
SHA512
009d297ce4bfb0794f94a1a0dc1c8cd647f9f7fea378794cf205639340a93986e648a17a4289e49afdd42876f88b99234c1c6b3f7018506d7534176c4530ef05
-
SSDEEP
3072:zK2uLk3NqMZhRlGHsKjrdWPhwRkb3OaYjzIEAOjL4RH2YT1uBV:zRuQ3AMCbWPmKbzYHASLUHrT0B
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ cartao.petrobras.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ cartao.petrobras.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ealm4503.dll cartao.petrobras.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REGSVR32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cartao.petrobras.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Carter.clsCarter cartao.petrobras.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Carter.clsCarter\Clsid cartao.petrobras.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3656 cartao.petrobras.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3656 wrote to memory of 5112 3656 cartao.petrobras.exe 84 PID 3656 wrote to memory of 5112 3656 cartao.petrobras.exe 84 PID 3656 wrote to memory of 5112 3656 cartao.petrobras.exe 84 PID 5112 wrote to memory of 3348 5112 cmd.exe 86 PID 5112 wrote to memory of 3348 5112 cmd.exe 86 PID 5112 wrote to memory of 3348 5112 cmd.exe 86 PID 3656 wrote to memory of 1144 3656 cartao.petrobras.exe 92 PID 3656 wrote to memory of 1144 3656 cartao.petrobras.exe 92 PID 3656 wrote to memory of 1144 3656 cartao.petrobras.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\cartao.petrobras.exe"C:\Users\Admin\AppData\Local\Temp\cartao.petrobras.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADDHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System/v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADDHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System/v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
PID:3348
-
-
-
C:\Windows\SysWOW64\REGSVR32.EXEC:\Windows\system32\REGSVR32.EXE /s C:\Windows\ealm4503.dll2⤵
- System Location Discovery: System Language Discovery
PID:1144
-