Analysis

  • max time kernel
    134s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 03:54

General

  • Target

    file.exe

  • Size

    1.7MB

  • MD5

    3833a1b7c23d66eecec6b16ddf5cf540

  • SHA1

    05182934e239a8e6715ada16e0ddcde3b7598e05

  • SHA256

    96f09e8bd3f67c287a0bb1529d5220d9496a233fba5b1608366a2c280a864dd2

  • SHA512

    3c824f5aa05ff6ba2a1f9d805d2d1f755f1a8a5646d367c325d0a7b6b38d0dfedd61e75f984fcc6686c27fd1a4c5147f874a9a468ef15aed589ed993d2033069

  • SSDEEP

    49152:8mRhmhK5ZSLue0v+HpxCBlwQhwegB589ooccs9GULcbHN1:JCKyvHpxC7BCLoULyt1

Malware Config

Extracted

Family

stealc

Botnet

puma

C2

http://185.215.113.206

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mozglue.dll

    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • C:\ProgramData\nss3.dll

    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • memory/3212-0-0x0000000000560000-0x0000000000BF5000-memory.dmp

    Filesize

    6.6MB

  • memory/3212-1-0x00000000779F4000-0x00000000779F6000-memory.dmp

    Filesize

    8KB

  • memory/3212-2-0x0000000000561000-0x0000000000584000-memory.dmp

    Filesize

    140KB

  • memory/3212-3-0x0000000000560000-0x0000000000BF5000-memory.dmp

    Filesize

    6.6MB

  • memory/3212-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

  • memory/3212-52-0x0000000000560000-0x0000000000BF5000-memory.dmp

    Filesize

    6.6MB

  • memory/3212-72-0x0000000000560000-0x0000000000BF5000-memory.dmp

    Filesize

    6.6MB

  • memory/3212-78-0x0000000000560000-0x0000000000BF5000-memory.dmp

    Filesize

    6.6MB

  • memory/3212-79-0x0000000000560000-0x0000000000BF5000-memory.dmp

    Filesize

    6.6MB