Analysis

  • max time kernel
    20s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 12:55

General

  • Target

    30f800c78aade26b39b433ff196b851126cd063f63c7f2c26aa9f1a5755ece04N.exe

  • Size

    3.0MB

  • MD5

    3556a21c919e258b15cfe0d767456830

  • SHA1

    4966c45cdb2497332c10063a280189b25b16b438

  • SHA256

    30f800c78aade26b39b433ff196b851126cd063f63c7f2c26aa9f1a5755ece04

  • SHA512

    e8076d5319f3a04b105a46960b19aeed3002e60ce1d10f427f62f69ec14fafa340e739f20bf3abc82a62037a0e809738ead469327139b71ed5069740d40fbc43

  • SSDEEP

    49152:Mb2NhwT2ImZkR4Da082diP6l8klHHMBz5BOkSVqjVw5usA3OaCehkB/v:MEhTIeDa0A6lbSzoqcA3XY

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 5 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30f800c78aade26b39b433ff196b851126cd063f63c7f2c26aa9f1a5755ece04N.exe
    "C:\Users\Admin\AppData\Local\Temp\30f800c78aade26b39b433ff196b851126cd063f63c7f2c26aa9f1a5755ece04N.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 156
      2⤵
      • Program crash
      PID:2280

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2316-0-0x0000000000400000-0x0000000000708000-memory.dmp

          Filesize

          3.0MB