Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 08:27
Static task
static1
Behavioral task
behavioral1
Sample
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe
Resource
win10v2004-20241007-en
General
-
Target
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe
-
Size
680KB
-
MD5
491fbb077253ef49c0acf742cb8d5833
-
SHA1
7d838f4ba2ca272156d24191b48a1cd6f64d9152
-
SHA256
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1
-
SHA512
d7187a54ee97c4013677e6d2dbb90f97773b18e403b73a260294d7c378977a048d82f2d04b5b58a393b7326a86ca3f959cdecc85cad97e4e124e023d9a16215e
-
SSDEEP
12288:UUGpgBiEzB+pCLd5wZGh+TaYzRUYBcYGsocX8FgH7EhdTa+:UtgRzB+wd5IGh+TzzqFYn4FgH7
Malware Config
Extracted
stealc
LogsDiller
http://77.220.212.32
-
url_path
/eb51242cada87444.php
Signatures
-
Stealc family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe -
Loads dropped DLL 1 IoCs
Processes:
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exepid Process 3956 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 464 3956 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.execmd.exetimeout.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 632 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exepid Process 3956 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe 3956 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.execmd.exedescription pid Process procid_target PID 3956 wrote to memory of 4952 3956 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe 87 PID 3956 wrote to memory of 4952 3956 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe 87 PID 3956 wrote to memory of 4952 3956 7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe 87 PID 4952 wrote to memory of 632 4952 cmd.exe 91 PID 4952 wrote to memory of 632 4952 cmd.exe 91 PID 4952 wrote to memory of 632 4952 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe"C:\Users\Admin\AppData\Local\Temp\7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7dcd3c8c9408c26e55384b50c6b05b1623523dac22973a48325b7ac3f2e99be1.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:632
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 16162⤵
- Program crash
PID:464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3956 -ip 39561⤵PID:4708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85