Analysis
-
max time kernel
68s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 02:14
Static task
static1
Behavioral task
behavioral1
Sample
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe
Resource
win10v2004-20241007-en
General
-
Target
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe
-
Size
1.1MB
-
MD5
7e0ba625a5ae332cda46a8185c0c5230
-
SHA1
c239176154abaab0187cbacc31c915ae66b78ac8
-
SHA256
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6
-
SHA512
61a0a31c270fdeb6cb77bee96494648de966384dfcf30788d56288fbed560f48af9275d1900be4755b1ef3da22160773be7b1bbb76e348e461a11ac82f8c0f82
-
SSDEEP
24576:+rfzXdaxgAOZGspkqLCVHpZktAIn1brR7ZHFGjbhDZlnN:2XdaxgAOZDp/Avkz1brR1HF69HN
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2384 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
eqsF872.tmppid Process 2980 eqsF872.tmp -
Loads dropped DLL 2 IoCs
Processes:
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exepid Process 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exedescription ioc Process File opened (read-only) \??\F: 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Program Files directory 64 IoCs
Processes:
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exedescription ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXA37.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXAF4.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\RCX249.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXFC90.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXFEB5.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\VideoLAN\VLC\RCXFFF9.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXFE8F.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jre7\bin\RCXFEA3.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\7-Zip\RCXF9BF.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXFC46.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXFCCD.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXFC5B.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXFC7E.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RCXCDB.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Mozilla Firefox\RCXFF52.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{C650E966-B14F-4E38-8E3C-8BE886B090A9}\RCX828.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\RCXFB04.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RCXFE.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RCXFCB7.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\RCXDD3.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\RCX18A.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCXFAF3.tmp 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
eqsF872.tmpcmd.exe82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eqsF872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exedescription pid Process Token: SeIncBasePriorityPrivilege 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exedescription pid Process procid_target PID 1580 wrote to memory of 2980 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 30 PID 1580 wrote to memory of 2980 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 30 PID 1580 wrote to memory of 2980 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 30 PID 1580 wrote to memory of 2980 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 30 PID 1580 wrote to memory of 2384 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 35 PID 1580 wrote to memory of 2384 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 35 PID 1580 wrote to memory of 2384 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 35 PID 1580 wrote to memory of 2384 1580 82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe"C:\Users\Admin\AppData\Local\Temp\82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\eqsF872.tmp"C:\Users\Admin\AppData\Local\Temp\82cdc70ac4cab6e7044ac8a170cbee94fff6ff41892e22bb3db127ddbf5cf7f6N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\82CDC7~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD520dbf807dc0e5a499a0f9c149941ce8b
SHA1b5ef8f64df0fdc4c04774416f8b6293ae765046c
SHA2566480ddaac6f2b2107dbb6e6a4dc56d4d3a6fa210925ee2e6e3a1e1172d33f43a
SHA5125167d7eec74fa19c602aa66dbaeb210395662cf217fe6d044e2bfbbf80e3f64274c2ad296105a4df868c89ea5e8eb8db6567d621f24cffd0bae20f2a0307767a
-
Filesize
9KB
MD5fc80202a8fc434099a9449b2a14c2d75
SHA19ca544e9bd5f4bfd84e9b769a9adeea8c86d2555
SHA256d3c794a3f404eb37cbf4038683a85678d04b28fc6f5d98f2a24116738de07b51
SHA51298292dc9a96ff137205a7874d3495eae8baa0b51e968d616257a7e7ae4291fe010f47bef923039002827d0ff115f154aafe11bf321d534e0a7870faa40f6d2d4
-
Filesize
1.1MB
MD54598ce58362a03112db69548ee6e89c0
SHA19fe142d4bc2c814cf3600cc515b7d380d629d972
SHA256a5dbc9ba67a78a5897ba88c84e840874a6ea1cd43f9f59575fa21e33e1eb440a
SHA5123ee589fc5ba1d2a2cb5a750ce42e5d274709ebed893e6b6976c3d4c44cd9f07fae8852655e4aff9dda4a6c0176cb3cb9c8d3d9e4025c3527dd643fbeb958c8d8