Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 01:33
Static task
static1
Behavioral task
behavioral1
Sample
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe
Resource
win10v2004-20241007-en
General
-
Target
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe
-
Size
455KB
-
MD5
19d0c3dec3923ac19cd4cf49239758a0
-
SHA1
99a3f171e11a11ed435600fd70e6350e5f273437
-
SHA256
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdf
-
SHA512
5e897fbde813c6d155c5b38a601e0e64c6d1d94df6d1b5ea52015260fe3df64a6d3ff74809080117f7ebec3105e9e7480acb306c59ce567fed59a54fd7d79825
-
SSDEEP
6144:X9iWOkjOhJIeKST38AZ16Jx+pziOQu1n:X0ujOJOSTsAKY
Malware Config
Extracted
stealc
default9_cap
http://62.204.41.177
-
url_path
/edd20096ecef326d.php
Signatures
-
Stealc family
-
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2184 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.execmd.exetimeout.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 2628 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exepid Process 2448 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.execmd.exedescription pid Process procid_target PID 2448 wrote to memory of 2184 2448 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 30 PID 2448 wrote to memory of 2184 2448 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 30 PID 2448 wrote to memory of 2184 2448 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 30 PID 2448 wrote to memory of 2184 2448 36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe 30 PID 2184 wrote to memory of 2628 2184 cmd.exe 32 PID 2184 wrote to memory of 2628 2184 cmd.exe 32 PID 2184 wrote to memory of 2628 2184 cmd.exe 32 PID 2184 wrote to memory of 2628 2184 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe"C:\Users\Admin\AppData\Local\Temp\36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\36adccf26258fc28030c7b0ce17e5c8525cc1127a8505558f1dfc8dd9a52efdfN.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2628
-
-