Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 09:38
Static task
static1
Behavioral task
behavioral1
Sample
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe
Resource
win10v2004-20241007-en
General
-
Target
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe
-
Size
680KB
-
MD5
c4ac7a7ee7a9529b0148d9a64c43801b
-
SHA1
f069ce0f887af125aa606f004f0b7baaf725f300
-
SHA256
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d
-
SHA512
6b4bb83cb7ef91ca6c524b05c50017f8a9b3acadbc2122e557990ecf5e16573f121ee6c95f9bf25afec28a66ef95881ccbe8a2197a03891031839616124caccb
-
SSDEEP
12288:HykVitmN3AUK9io6BF74ZNNuJby8gAmp+U0KtQRJxYTIEs:HykYAF74BuJEAmp+5Kmhx
Malware Config
Extracted
stealc
LogsDiller
http://77.220.212.32
-
url_path
/eb51242cada87444.php
Signatures
-
Stealc family
-
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2864 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exepid Process 1632 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
timeout.exe7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 2740 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exepid Process 1632 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.execmd.exedescription pid Process procid_target PID 1632 wrote to memory of 2864 1632 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe 32 PID 1632 wrote to memory of 2864 1632 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe 32 PID 1632 wrote to memory of 2864 1632 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe 32 PID 1632 wrote to memory of 2864 1632 7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe 32 PID 2864 wrote to memory of 2740 2864 cmd.exe 34 PID 2864 wrote to memory of 2740 2864 cmd.exe 34 PID 2864 wrote to memory of 2740 2864 cmd.exe 34 PID 2864 wrote to memory of 2740 2864 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe"C:\Users\Admin\AppData\Local\Temp\7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7a3c1f0a826eec9b77bbe25a3da2db497d2005238c494190f075b0a22b21006d.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85