Overview

overview

10

Static

static

5

934521da6f...6N.exe

windows7-x64

10

934521da6f...6N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 04:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe

  • Size

    6.5MB

  • MD5

    baf46987333d96fd600bc8e072616ea0

  • SHA1

    9996afc71c15e8fc0fc5f3628f9f669696d694b8

  • SHA256

    934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6

  • SHA512

    9680ba058134bf89bca8c05e1d281d5b962faffdd0c50a38d9e3b2f519bd0e95bf118f7be2546184ecf5367d5f07699ae9bc927bd3e086f137938f91c979a7dc

  • SSDEEP

    196608:47effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu9OryfEQdy38doQaoiny/mKi:47effIPEsy58doQaTzwZ8Jq3QKnqVtxv

Score
10/10
adwarediscoverypersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 3 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 5 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
    "C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
      C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
        C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
          C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
          4⤵
          • Enumerates connected drives
          PID:3484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 1796
          4⤵
          • Program crash
          PID:4516
      • C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
        C:\Users\Admin\AppData\Local\Temp\934521da6fcf89b513f1b06ec3277d16a62d3d212ac6a1dc7f3b9e6f6e21fba6N.exe
        3⤵
        • Enumerates connected drives
        PID:2064
    • C:\Windows\SysWOW64\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
      2⤵
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      PID:2360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1220 -ip 1220
    1⤵
      PID:3160

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\cftmon.exe
      Filesize

      6.5MB

      MD5

      f185b7ca2647cef7e4bfbf494b185773

      SHA1

      3feb3916b2a163cc33186d8e17d923d17a48f78d

      SHA256

      bfb3d61b26eec31e00dd0f2c6559d202d4ecfaf5824f603df1f5833108093677

      SHA512

      14f5f27c7ac43dc567606ed69e80f54dbd5a525705c193354225ddd1ffe5314f424bd3d30ef21161b77d7fa49d99e5a3ce2729ce359b15b49a48b245eb7ba121

      Download Submit

    • C:\Windows\SysWOW64\drivers\spools.exe
      Filesize

      6.5MB

      MD5

      335a866184211202c70121fde1edc6ee

      SHA1

      eaf8bd7fec26bafa19908d1cc9443c9bea732608

      SHA256

      d91676d12fa40a63aa41742f200639819cf9ba50c578b8c8a1a0c0e5632236f7

      SHA512

      a1934aebaa496812db8f008008f88a0c1e7b0021b4e12fc7f348f914458df01faf50063a56666930db6dff7adef7876a92e7680580dcb56a55b58c719b29815f

      Download Submit

    • C:\Windows\SysWOW64\ftpdll.dll
      Filesize

      5KB

      MD5

      d807aa04480d1d149f7a4cac22984188

      SHA1

      ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

      SHA256

      eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

      SHA512

      875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

      Download Submit

    • memory/1220-16-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1220-29-0x0000000010000000-0x000000001010B000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/1220-30-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1220-32-0x0000000010000000-0x000000001010B000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/2064-35-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2064-37-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2064-17-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/3484-38-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/3484-36-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4912-13-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4912-15-0x0000000010000000-0x000000001010B000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4912-0-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4912-12-0x0000000010000000-0x000000001010B000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4928-33-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/4928-66-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download