Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 11:51
Static task
static1
Behavioral task
behavioral1
Sample
3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe
Resource
win10v2004-20241007-en
General
-
Target
3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe
-
Size
362KB
-
MD5
fc148c7ac5b051bff69132510070111c
-
SHA1
907a5f1bedf76caafa4dbe6c44a73f68102c1e99
-
SHA256
3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902
-
SHA512
68c2d90f37d2f8976e34e07ff975775d802df70f089352cbebfb2b010a80e3fbc5b307fc00f72faf9cc359f9cf74accb8d5887f7d084bfd52c2696a3ec9881c9
-
SSDEEP
6144:0bUUyKiCMR7q3HhN4ZDYCg2eyd6Jo4vb/noeUDebE8B:0bU1RGRITgs8JPLKDebEg
Malware Config
Extracted
stealc
default9_cap
http://62.204.41.177
-
url_path
/edd20096ecef326d.php
Signatures
-
Stealc family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4900 5008 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4808 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5008 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe 5008 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5008 wrote to memory of 2732 5008 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe 89 PID 5008 wrote to memory of 2732 5008 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe 89 PID 5008 wrote to memory of 2732 5008 3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe 89 PID 2732 wrote to memory of 4808 2732 cmd.exe 94 PID 2732 wrote to memory of 4808 2732 cmd.exe 94 PID 2732 wrote to memory of 4808 2732 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe"C:\Users\Admin\AppData\Local\Temp\3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3488e03d77adbc21c7b2c40c25efad0e8460edc622b39a6f710573555640e902.exe" & del "C:\ProgramData\*.dll"" & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4808
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 13522⤵
- Program crash
PID:4900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5008 -ip 50081⤵PID:3224