Overview

overview

7

Static

static

3

fe3c0cf0c4...cc.exe

windows7-x64

7

fe3c0cf0c4...cc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2024, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe
  • Size 1.3MB
  • Sample241102-wpezza1hnl
  • SHA256 fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
defense_evasiondiscoveryspywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe
        "C:\Users\Admin\AppData\Local\Temp\fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4268
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78AA.bat
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\Users\Admin\AppData\Local\Temp\fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe
            "C:\Users\Admin\AppData\Local\Temp\fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4872
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe advpack.dll,LaunchINFSection campaign.inf,DefaultInstall
              5⤵
              • System Binary Proxy Execution: Rundll32
              • System Location Discovery: System Language Discovery
              PID:1720
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msninst.exe
              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msninst.exe /Action:Wait
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1048
        • C:\Windows\Logo1_.exe
          C:\Windows\Logo1_.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:788
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2044
          • C:\Windows\SysWOW64\net.exe
            net stop "Kingsoft AntiVirus Service"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4080
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3092

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          GoogleUpdateCore.exe
          • Path C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
          • Size 250KB
          • SHA256 f799279fc912627d1f88cdc1741a34a4b0f7f6536657d21f8eb2e27a0502dad8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 577KB
          • SHA256 91781a9504b2da3779faeffe029e6cbd3b0b3456f333a19dcc5a1ac251e8b5be
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msninst.exe
          • Path C:\Program Files\MSN\MsnInstaller\msninst.exe
          • Size 162KB
          • SHA256 d08e04affb1a72b5afa6823e7e741cacc88ac85d60593176f67188a0eac3537a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          windowsdesktop-runtime-8.0.2-win-x64.exe
          • Path C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
          • Size 643KB
          • SHA256 86d5ce82c71e2c3c86b994d4e0ed1ba15106dbf9b1319d3d8270794346c63d5d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          $$a78AA.bat
          • Path C:\Users\Admin\AppData\Local\Temp\$$a78AA.bat
          • Size 722B
          • SHA256 f5150e346a55e9b2a0e7772d82c45d16a4b9ce401898c663b950eb5e879acbfa
          • MD5 SHA1 SHA512
          Submit Download

          ADVPACK.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
          • Size 90KB
          • SHA256 06eed244d89f6e15205d5beb8085ac33c0de486dfe30eec9fb73b91de07e5f62
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MsnInst.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MsnInst.dll
          • Size 244KB
          • SHA256 30714be137b7b648b0c3aa2a7410467289b53a8e2601f8c208a3613e1d31d0f0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          campaign.inf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\campaign.inf
          • Size 1KB
          • SHA256 80ed31ae5890469ee38fe7b950149e2f488344d892f1ef5ac3dc3e7ff3de2d6c
          • MD5 SHA1 SHA512
          Submit Download

          iasvcstb.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iasvcstb.dll
          • Size 26KB
          • SHA256 ace81690c98cb396758dc016a76b77706924dd3a8598b3a0492bc12edb9af153
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          install.mar
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\install.mar
          • Size 516KB
          • SHA256 2143c7a5aa2f9d321fbd902d80ac43f4fe9c684d2e5a55fbc686820e06261d9f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msdbxi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msdbxi.dll
          • Size 82KB
          • SHA256 2c2b10bb87662d1d61916784106a82cff510add0972112a9a14c03927b2d0846
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msnihc.mar
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnihc.mar
          • Size 21KB
          • SHA256 65118f920c6912e6a7dc6325698570fc7fa79beeb64d6204e6ca93f68ae0f692
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msnilc.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnilc.dll
          • Size 31KB
          • SHA256 3f0e18479c7f8f75045d88605bbfa290663092464816739080b21b02d61f2588
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msninst.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msninst.exe
          • Size 129KB
          • SHA256 66d7811a891b614f7fc174ae5a3ea1d29d1edde50b12fcaf51c0dc5b54a20b4a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msnitd.mar
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnitd.mar
          • Size 62KB
          • SHA256 35f135fd9c04cdaf78bad191872cc1aa9cc38056f7c76ba29f0669be9e07210d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msnms.ico
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnms.ico
          • Size 24KB
          • SHA256 090ee05cef8113594959c4ba3d992eb1e5d2effb7f71ba8854adee27b8b6cf95
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msnsign.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnsign.dll
          • Size 746KB
          • SHA256 ccec6240c7a188e55156476d1bfcd06722c36bd7555f28845d747493529093d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msnsusi.inf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\msnsusi.inf
          • Size 5KB
          • SHA256 581a7e5bcf20a47f55e980b3b35e3881d72bb8c65f380857831906c9e6e332fd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unicows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unicows.dll
          • Size 239KB
          • SHA256 22f23cc65698741184ec34f46e6f69717644e0b5aabf5d5bd015101f2d72e56e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe.exe
          • Path C:\Users\Admin\AppData\Local\Temp\fe3c0cf0c4e6577607832a28467c3788f48a3e036dd7075a3d6ce5e1dca1fccc.exe.exe
          • Size 1.3MB
          • SHA256 4ecd3f8b60c60870cdd67abf319b373c3438bb7bceac46209b2c87bd5e73a3f6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Logo1_.exe
          • Path C:\Windows\Logo1_.exe
          • Size 33KB
          • SHA256 367905db0d74a6f652f2b1baadd612fab82d9e6206ad7b04d10d3bc73462df55
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _desktop.ini
          • Path F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\_desktop.ini
          • Size 9B
          • SHA256 8f3923d1760479509501e7072113c91029fcae19adc185a54d721e08326d78cb
          • MD5 SHA1 SHA512
          Submit Download

          memory/2164-200-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/2164-2538-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/2164-9-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/2164-7226-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/2164-8959-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/3984-0-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/3984-8-0x0000000000400000-0x000000000043F000-memory.dmp
          Download