10b956449191907929102ae12fdf6a4c51ba5a0aa168259608f502d1a70c931c

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InstalllingFile_x64_x32mbit.exe
Size

2.5MB
MD5

5f477f10523a2df0a5580664d799919d
SHA1

f776d76a9026f6251ec9a639f9e559c852b0bb66
SHA256

44ef5b01f886351aae52d3ca5e5e4bb1c46e7f77df9290d47dbaf3886416ac20
SHA512

d0cc3ae08d8ec8d860ff83ffd52c1ce12c9e87a6dcc5d38f1efef182f950ba49e5921412d596cbacb277854d83a5fc1b5c14f00581ae2336d2ba18c3860dc5fb
SSDEEP

49152:Ug9CYJyi2n3hhHYJ8RTJ3e61hqJ3scTvn0ziy685IFUbAeFFHvG9FJk82GlXX1:xCYJyiS3bHYJ8RTJ3JOJf0G85IFUbAeE

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstalllingFile_x64_x32mbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1736	2520	InstalllingFile_x64_x32mbit.exe	30
PID 2520 wrote to memory of 1736	2520	InstalllingFile_x64_x32mbit.exe	30
PID 2520 wrote to memory of 1736	2520	InstalllingFile_x64_x32mbit.exe	30
PID 2520 wrote to memory of 1736	2520	InstalllingFile_x64_x32mbit.exe	30

C:\Users\Admin\AppData\Local\Temp\InstalllingFile_x64_x32mbit.exe
"C:\Users\Admin\AppData\Local\Temp\InstalllingFile_x64_x32mbit.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-31-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2520-39-0x0000000000E20000-0x00000000010B0000-memory.dmp

Filesize
2.6MB

Download