Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2024, 08:26

General

  • Target

    70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe

  • Size

    225KB

  • MD5

    744c28c76889701b6d77f530ade27be9

  • SHA1

    8fc6e595c8c1db35663885e3fb594e826b693be2

  • SHA256

    70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064

  • SHA512

    09d59a97726c3d87693f8ee2456f8e5667347c9c028cd62fc06a3818f41ef7fc05a0ff72189bced0c1a918ae648c8aae366ec5b318e868bbc287eccb1a2527a5

  • SSDEEP

    3072:osXRmUIMitiMQose27vc+Eld+xZp2vPRL1tT06zJoxAWBcKpSP//dwRmyHL:JR5IuMQoseGk7RZBGxAycKpSPX2NHL

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe
    "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
      "C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2308
      • \??\c:\windows\microsoft.net\framework\v2.0.50727\InstallUtil.exe
        "c:\windows\microsoft.net\framework\v2.0.50727\\InstallUtil.exe" C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2460
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe\" arguments" /sc MINUTE /mo 1
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2616
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:2300
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe" && del "C:\Users\Admin\AppData\Local\Temp\70c825b4524ea9a24c6dc73c8f5d8e2580ec663e124e767886424c5df6b4b064.exe.config"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2428
        • C:\Windows\system32\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:2816
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:2088
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {872E121F-B80E-4E74-9089-9DCA5ECAFD84} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
          C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe arguments
          2⤵
          • Executes dropped EXE
          PID:616
        • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe
          C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe arguments
          2⤵
          • Executes dropped EXE
          PID:2148

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe

              Filesize

              225KB

              MD5

              13368347ebf33d72487458d752f3a3f6

              SHA1

              a5673f20c30e076c39f5e23247b5d5429c24ed4d

              SHA256

              60d6beb2cf8a84a73543c7f9b2a94f155fdd7c896837795375928d3537384c9a

              SHA512

              5741914e29e1224c0cbaf23563f572baaaf6b3379f30f335ee029317b296aa6d954e492967f3dc22cc977a19dbf19f22ab34c8273127fa575c491db852497c6c

            • C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\logagent32.exe.config

              Filesize

              1KB

              MD5

              dd3d04c365984b4ec57a80503f81fddf

              SHA1

              c55fbcb61818e47dac9aae465faff91f0805bd7c

              SHA256

              40a59ca9744dc3d4647f246b2dc553f37f8095418c1b48a9bd94cdb5c03dbc5c

              SHA512

              0dd459def2abe9e3f0d1251049a0755c63f7dd3d85e91dba272c3f479f2578e3f3f2379e1cd6913190f7f596af721201eb5d9423ab28aed72bde5cd3cac7f785

            • memory/1776-0-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

              Filesize

              4KB

            • memory/1776-1-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/1776-2-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/1776-4-0x000000001ACE0000-0x000000001AD02000-memory.dmp

              Filesize

              136KB

            • memory/1776-6-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/1776-5-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/1776-7-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/1776-3-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/1776-16-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/2308-17-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/2308-20-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/2308-18-0x0000000000D90000-0x0000000000DB2000-memory.dmp

              Filesize

              136KB

            • memory/2308-19-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/2308-34-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/2308-33-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

              Filesize

              9.6MB

            • memory/2460-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2460-30-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/2460-27-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/2460-25-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/2460-23-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/2460-21-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/2460-31-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

            • memory/2460-32-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB