Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe
Resource
win10v2004-20241007-en
General
-
Target
acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe
-
Size
98KB
-
MD5
cb410dcc4cade0a487fb85f90d6e65b0
-
SHA1
4e6b4d6222d9b36bebc324ccdd31813e95636a60
-
SHA256
acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568
-
SHA512
a71781f8497050510abe97736f681b04e6e06b8fead32c60835f624c077371e75daa93ea90f63b9b7f2d02107971d4349aa705d406915bce23a9eb5e5d1d57e1
-
SSDEEP
1536:Jy6JHfRr4vkK/sTZSGJcXaDNUjVa51UysWqEdU9dldSGyBkch:E6FfREvkgsTv6qDNUgzU7usKGuks
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2684 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\RCXB7CE.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\RCXB883.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\DVD Maker\RCXB5AD.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB67E.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\RCXBADB.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\RCXC04A.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMC.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB651.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\RCXBAFC.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Internet Explorer\RCXB63D.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows Mail\RCXB983.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\RCXBBBE.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB669.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB693.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB667.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB6F8.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\RCXC529.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RCXB509.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\RCXBBF2.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXC2A5.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows Media Player\RCXB9B6.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RCXBB46.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB6D0.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows Media Player\RCXB9E2.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXC23F.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\RCXB59C.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCXC417.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\RCXB734.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\RCXBBF3.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows Sidebar\RCXBA3C.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXC1CB.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Windows Media Player\RCXB998.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\RCXBADA.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\RCXBB12.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Internet Explorer\RCXB625.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXB83D.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\RCXB894.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXC08D.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXB640.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Microsoft Games\Chess\RCXB860.tmp acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35 PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35 PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35 PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35 PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35 PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35 PID 2672 wrote to memory of 2684 2672 acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe"C:\Users\Admin\AppData\Local\Temp\acd4eedb6c2cc349bba703c30268acea67eafa7e5a6d7e07005bf5ccb624b568N.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ACD4EE~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a7f5691c267a8593b4ded27dace10ea2
SHA10c31e43c52dc170d5484c2780f1907ded50988fd
SHA2567363b2ea3295880e3c50677eb7db08d841bb40c9b072332737069e64dece820b
SHA512146a15108b6079e8a6d057b45b369858c083094c6937ca781db5b6c4926f12d07850e9857ddeb8d5bc8c7918347d79b4412be59983de7c6bb3f382b41a1dda62
-
Filesize
9KB
MD5fc80202a8fc434099a9449b2a14c2d75
SHA19ca544e9bd5f4bfd84e9b769a9adeea8c86d2555
SHA256d3c794a3f404eb37cbf4038683a85678d04b28fc6f5d98f2a24116738de07b51
SHA51298292dc9a96ff137205a7874d3495eae8baa0b51e968d616257a7e7ae4291fe010f47bef923039002827d0ff115f154aafe11bf321d534e0a7870faa40f6d2d4
-
Filesize
458KB
MD5866454fe10e1eeb551203a35a11be884
SHA1317da88a276a8638a35d6ab5618372fd7cb9f7cc
SHA256265ae7b5af41972bba1f4741c4f96533b2e00657c32073a009b6bbd089641e4b
SHA512213738511c335689d2230286ec6ed9dec7d9efbf9cbb2f7d08106d214482161630010171a3c939df83c9eac02caafb961913d8cf485b1c783d2b0e81f9831efc