94915435031e2268af34f2d6e17df6db29137584b033c53e39cd2ae5ac0ae304

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:44

Target

SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exe
Size

38.5MB
MD5

25328964e86c43023c38d23c0fe59e00
SHA1

7d045947ad7a7e7efd29dc65285bdf7bcd070801
SHA256

a65131b4a2afa0bbc3d7fa3db1c4a58fd3b8498a7b289013852d2979f40818d4
SHA512

107dedbdc1c72f3d5c15a8d2bccd81f9b152273bbeba9f6e8aba3604f9ef042824275df5bdc7316ed08bfe792e443731fd5ab9016ae8821ff8db1e5ac108c222
SSDEEP

786432:Ecvs6szlRsqmzZCAQmzRwb8LdrJhb+cha+2DuTLOkekcyHvvBpdFm:3vsRROzZNQmzRwb43+chJ2DE5cyHHB3Q

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

Stub.exe

pid	Process
2324	Stub.exe

Loads dropped DLL 2 IoCs

Processes:

SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exeStub.exe

pid	Process
2936	SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exe
2324	Stub.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exe

description	pid	Process	procid_target
PID 2936 wrote to memory of 2324	2936	SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exe	29
PID 2936 wrote to memory of 2324	2936	SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exe	29
PID 2936 wrote to memory of 2324	2936	SecuriteInfo.com.Trojan.PWS.Stealer.39881.18601.exe	29

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\onefile_2936_133746183436376000\python310.dll

Filesize
4.3MB

MD5
e4533934b37e688106beac6c5919281e

SHA1
ada39f10ef0bbdcf05822f4260e43d53367b0017

SHA256
2bf761bae584ba67d9a41507b45ebd41ab6ae51755b1782496d0bc60cc1d41d5

SHA512
fa681a48ddd81854c9907026d4f36b008e509729f1d9a18a621f1d86cd1176c1a1ff4f814974306fa4d9e3886e2ce112a4f79b66713e1401f5dae4bcd8b898b9

Download Submit
memory/2324-34-0x000000013F3A0000-0x0000000144DDF000-memory.dmp

Filesize
90.2MB

Download
memory/2936-63-0x000000013FE20000-0x00000001424D4000-memory.dmp

Filesize
38.7MB

Download