Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
19/11/2024, 15:12
General
-
Target
73c17409cb9514828e06522fec9c823c324c39e992db2f45b17e855e81f0bd78N.exe
-
Size
2.6MB
-
MD5
5b23ddde0f2f5a9a0610ebedaa2886d0
-
SHA1
b04e45075999a89ea7e872905a5e96851389bdaa
-
SHA256
73c17409cb9514828e06522fec9c823c324c39e992db2f45b17e855e81f0bd78
-
SHA512
50192825ef3d62c884380ba141139fc6a1193f98549d212e0cd7641ddf871b01eef354cf45e1ee6d6d251e5c4e2aa8ba835fbef0e9fdbb4f85e3ef0d8f87203c
-
SSDEEP
49152:sxX7665YxRVplZzSKntlGIiT+HvRdpcAHSjpjK3LBVB/bS:sxX7QnxrloE5dpUpab
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c17409cb9514828e06522fec9c823c324c39e992db2f45b17e855e81f0bd78N.exe"C:\Users\Admin\AppData\Local\Temp\73c17409cb9514828e06522fec9c823c324c39e992db2f45b17e855e81f0bd78N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysxdob.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\AdobeIM\devoptisys.exeC:\AdobeIM\devoptisys.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5bf01dec9fbdc0003ecbdc8b673632ade
SHA1a0ae1ab697c4f332d38cd279c3a6d6b64a7c28c5
SHA2564ded2574fcef82c85651d0fd6e116bc2997e8c52fa39b20eae3b6f9bb094489e
SHA512379a62269853e876b26e51b700d528aedc4c9493cd308b88d7b00d6efd6e0c93523ef83413d0bf5696fe53b7776ebed9e53ac4dda794d27f42723a9bd3d72d5b
-
Filesize
2.6MB
MD512ef27876f61ecd1c70630c1dfcc7db2
SHA1f1c5d525502534ae3751c80ffc3f5e33414b9f9e
SHA256252bb415ed0f07f95c5265a0ce8d3a480bb2d602b47392c99ab4441f8689f48f
SHA512a40c5f440dc073e771d7fb2eee6c86a07ad66603d8da2239ad9ad62095382469812f19ab69357cd8f8ba02f94ec1ea9738b89b8290f88bc4680292eafdc04432
-
Filesize
174B
MD554f4ee32093e7219d3343fd8e172cbaf
SHA1e20e38c930b70e0a22ff863ed04681154236540c
SHA256497c77623c7292507c9abb9582c31bb318479040b2f0e7dc888d385d4ce467d0
SHA512cd3206ae4506de1d3ec805b3d8bf94795d99cfc6377194d2e21dea82acea7be19bb8c95e14d05c831143cde2ceffe3a22d134336b707b5f8d126b2de9d435fd1
-
Filesize
206B
MD50d4bf74564c7ac381fffa9fc3fae140b
SHA1e7c7e90d090641f7ccff0818e37c2700b69b53a8
SHA256b7c95179918538ef0e48dd070c41308bfffc5f0d3aab74453f13cfedc3a9d6ee
SHA512ca9e004b63c8ce7cb89b71064128c894fb35be2660997fae3338b58c1d63c4accc2fafd214c17d5d6a75b55ca6ebb7acad49e4af1dae8a7c2b740e6afd7d24f2
-
Filesize
2.6MB
MD519a3188eedf11eb89e6f94e116b7c017
SHA132f392bce7c4a9dea62d72195826471ac864a1bf
SHA2564b60d206bf35fd3946a06e8b8c19474afa5981c800843fb20eb3b05679f373b9
SHA51229fa2bb606c40cc5b65ae39689ec372434e596f27c9d217bf3e4232cec8046cf0f4f79685d3183eb8022a76f18687dba72ddeee295a796b3bd2745556a83845f