Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05-11-2024 11:11
Behavioral task
behavioral1
Sample
ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe
-
Size
149KB
-
MD5
847291ec10f4c2ec9704e647f3985384
-
SHA1
b304c676cc362fef6229e4e4fd4f40ab64552209
-
SHA256
ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8
-
SHA512
105ae68d92fb055a6fd88f2d95c73afffeec3f603996678cf7da1c62c01b2bc2e3a57ab1602049d3844207d20d688380835665e95ec103a6c7ccaa3914014a7d
-
SSDEEP
3072:N6glyuxE4GsUPnliByocWepFAkrUmcmWDVGRJ9Y:N6gDBGpvEByocWe7AuUmcm2VGz+
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2696 AB5C.tmp -
Executes dropped EXE 1 IoCs
pid Process 2696 AB5C.tmp -
Loads dropped DLL 1 IoCs
pid Process 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2696 AB5C.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp 2696 AB5C.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeDebugPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: 36 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeImpersonatePrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeIncBasePriorityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeIncreaseQuotaPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: 33 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeManageVolumePrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeProfSingleProcessPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeRestorePrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSystemProfilePrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeTakeOwnershipPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeShutdownPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeDebugPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeBackupPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe Token: SeSecurityPrivilege 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2696 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 30 PID 2844 wrote to memory of 2696 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 30 PID 2844 wrote to memory of 2696 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 30 PID 2844 wrote to memory of 2696 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 30 PID 2844 wrote to memory of 2696 2844 ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe 30 PID 2696 wrote to memory of 1668 2696 AB5C.tmp 31 PID 2696 wrote to memory of 1668 2696 AB5C.tmp 31 PID 2696 wrote to memory of 1668 2696 AB5C.tmp 31 PID 2696 wrote to memory of 1668 2696 AB5C.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe"C:\Users\Admin\AppData\Local\Temp\ddecf455e6cfd04276814dba2e6f642eca80c0f09a912b97f483233b81a4afa8.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\ProgramData\AB5C.tmp"C:\ProgramData\AB5C.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AB5C.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1668
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5595d3f173bcb84ed34038689c0bda766
SHA1dbaa62f945e6cd93de265548633afe7bfbb5eaba
SHA25692721b43e2575717079a9df40989c5a41b328d71eee1dd71fea4dbf7d63473ba
SHA512803572bbec6f585b4a226d910d8e7b8a83820ef2611b5386000d93f3ab9282a1605001d3cec450142baca9754acc8c60b76c175da09a53936ddc6862d1862fb6
-
Filesize
2KB
MD5b2ee65a230019cd9d69d605d2c392ecc
SHA1ac8e8570fa756081c6892f6d225be0a7e93c64a2
SHA2561ebde9c1e86e81403a167afd1c80590c147ee530280f8dc45860c2da111fa707
SHA5129daaf0eb4abc4e8ccc0bb4c4bca4f2762a5beea2a7fc2c7a10fbfa77004d42905b0ec4aae397bc64050d7da7cf1bacd38f5833a7791dbb279b1ff4b90c831baa
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize149KB
MD522ac765c7a22d93befee4cdafa1f8c55
SHA15107e2a7190458a0fed5115b8f41c1b38327a819
SHA2563989fff74c9857105b71fb39a70f9bd72e55488715eca07f00a93547ffd9a7ef
SHA512b4796cf54fad006a38d2501fb54c258742427e962d13ffa3c3edc343b3a812c6b482667b202e2c49a40a516f90760a241d3ad536f16545a92bdcdf47f4ccc657
-
Filesize
129B
MD5c23d1aca10a5d0f298f786015b4c294d
SHA15956fcfbb733e4171fe43fdc7c488961f645f2d6
SHA2561d360f881492109ce6249bd8a09a43e31e8c64037aa1f38fdd93383941191965
SHA5126ba80bb8134e330b46b0d1f84c0ff24e59f7620b74bb7b2ab9cb04b36feae59d1f4509851c4ae96b555f5085e2730cd397fd6ce870608412155d76897b3e5b2a
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf