Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23-11-2024 03:13
General
-
Target
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe
-
Size
145KB
-
MD5
913458a5e9eb4026c62609375b534227
-
SHA1
9739ae38effef090b3b558531e01bf2252bd018f
-
SHA256
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6
-
SHA512
5b653989cafdbd586216ccd11d243001b066b044df93478f574577f170b72a84b3831c89933c023ac458d8c2d4fb2fe4cdfcac0608806258150c3df101a79275
-
SSDEEP
1536:DzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDXcl74OOjAp31AyNpCSV6O9xv2T:cqJogYkcSNm9V7DG98YlXjCSV6O9R2T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe"C:\Users\Admin\AppData\Local\Temp\c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\893C.tmp"C:\ProgramData\893C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\893C.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a409c242772b57918dcdb1ad6f63d928
SHA12f12e3ba16d1675a486e1bf1a6b7ba8df3ca4785
SHA2566360d650e8076ebd96536ca5551eb8625423d3f9948766090d56e279534fe34d
SHA512cd84db443b610fee2b789cb5a103a813a3915c195583c75e58a9339d47484e33393658e6caf595b8e557482e01a34aa6e08136763abccdf3ef379ead56f65a03
-
Filesize
452B
MD5df4a71cb794c90af5dde68ddde58679c
SHA1b41189e86496336fa87609e126405c56632a89fa
SHA256d0ba36aaf088c9ed91401e1395abe25adeb8f85e5318e36ed5a3ae3f917cba82
SHA512aab489cd69256359b9160d2dbf996e8eed8760cd39deb2dd1651978535d7decd8d0460f1f31cd30c764bd005e4c36ab5a3560c986cdde497192c26c696c227a9
-
Filesize
129B
MD5bb56bb8e8fc3bbd5623d245c5a8113c2
SHA1e1b8fe60a0c557570d7decc434b54897d27e7414
SHA25669ec66c87645707c7f8db09d6124168289eb285655da64ce11d4d670b4c0a039
SHA512effd70a8fa84505e9e9c0ff6bef4bd6819392705820cb684fd834d40ee5f0c86c4ef51d96af3e6f4bbb47cc9ce3acf89f0f12377389a004addcc5590ea937835
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
12KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
256KB