abff8ad79e497aeb5787012b0b0b718324e98bff7e703071c9fe75d6e534b6d6

Resubmissions

27-11-2024 13:27

241127-qqdkmsvnhz 10

27-11-2024 09:28

241127-lfrx3atrgr 10

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
Size

6.5MB
MD5

145d87e44b5607f5cbe102d1f5afe333
SHA1

62f3e3e1535a1955853f4c2628cf31d99197bf1d
SHA256

7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8
SHA512

6edabdff5cb316045f20e4de4334e5e6f7aa2909436b94cd4da6f34929682caec31c6e4bdab1992399e9a97c48c51dd4ea2228c055bf523e9a661c710bdb5b4c
SSDEEP

196608:LrJnLa9onJ5hrZERVM+ENFJzFcguwW+W7THsC3k:NG9c5hlERVMRFJzFcgupl7TN

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 13 IoCs

pid	Process
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com
6	discord.com
7	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2656	2156	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe	31
PID 2156 wrote to memory of 2656	2156	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe	31
PID 2156 wrote to memory of 2656	2156	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe	31
PID 2656 wrote to memory of 2596	2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe	32
PID 2656 wrote to memory of 2596	2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe	32
PID 2656 wrote to memory of 2596	2656	7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe	32

C:\Users\Admin\AppData\Local\Temp\7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
"C:\Users\Admin\AppData\Local\Temp\7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
  "C:\Users\Admin\AppData\Local\Temp\7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls&title [Discord Nitro Generator v5] By xEmotional
    3⤵
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI21562\VCRUNTIME140.dll

Filesize
99KB

MD5
18571d6663b7d9ac95f2821c203e471f

SHA1
3c186018df04e875d6b9f83521028a21f145e3be

SHA256
0b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f

SHA512
c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\_ctypes.pyd

Filesize
123KB

MD5
8adb1345c717e575e6614e163eb62328

SHA1
f1ee3fff6e06dc4f22a5eb38c09c54580880e0a3

SHA256
65edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8

SHA512
0f11673854327fd2fcd12838f54c080edc4d40e4bcb50c413fe3f823056d189636dc661ea79207163f966719bf0815e1ffa75e2fb676df4e56ed6321f1ff6cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\_hashlib.pyd

Filesize
45KB

MD5
5fa7c9d5e6068718c6010bbeb18fbeb3

SHA1
93e8875d6d0f943b4226e25452c2c7d63d22b790

SHA256
2e98f91087f56dfdffbbdd951cd55cd7ea771cec93d59cadb86b964ed8708155

SHA512
3104aa8b785740dc6a5261c27b2bdc6e14b2f37862fa0fba151b1bc1bfc0e5fb5b6934b95488fa47c5af3fc2b2283f333ff6517b6f8cf0437c52cf171da58bf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\_lzma.pyd

Filesize
158KB

MD5
60e215bb78fb9a40352980f4de818814

SHA1
ff750858c3352081514e2ae0d200f3b8c3d40096

SHA256
c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806

SHA512
398a441de98963873417da6352413d080620faf2ae4b99425d7c9eaf96d5f2fdf1358e21f16870bdff514452115266a58ee3c6783611f037957bfa4bcec34230

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\_socket.pyd

Filesize
77KB

MD5
1d53841bb21acdcc8742828c3aded891

SHA1
cdf15d4815820571684c1f720d0cba24129e79c8

SHA256
ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b

SHA512
0266bcbcd7ca5f6c9df8dbeea00e1275932dacc38e5dd83a47bfbb87f7ca6778458a6671d8b84a63ae9216a65975da656ba487ac28d41140122f46d0174fa9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\base_library.zip

Filesize
768KB

MD5
d235f1864919c4d415d38e1ebef8a5b8

SHA1
8811f8fdc750549e0929ea69aef5e742a6b1c1c3

SHA256
9f59f99317adbf3d0aab4d2bc61fe7e5676a448784d70bbccecf794e1e23d15b

SHA512
a21e025c8b778a7b6b38f7ee2aa699fc1c1780d5a5758d28659cc673b3c072b99877907d7a6569081ddfb7e0324c95bd6796857b3b1874a2e7c6bbc07eca6f22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\python38.dll

Filesize
4.0MB

MD5
1f2688b97f9827f1de7dfedb4ad2348c

SHA1
a9650970d38e30835336426f704579e87fcfc892

SHA256
169eeb1bdf99ed93ca26453d5ca49339e5ae092662cd94cde09fbb10046f83fc

SHA512
27e56b2d73226e36b0c473d8eb646813997cbdf955397d0b61fcae37ed1f2c3715e589f9a07d909a967009ed2c664d14007ccf37d83a7df7ce2a0fefca615503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21562\unicodedata.pyd

Filesize
1.0MB

MD5
549c9eeda8546cd32d0713c723abd12a

SHA1
f84b2c529cff58b888cc99f566fcd2eba6ff2b8e

SHA256
5d5e733397ef7c4946cf26c84b07312cb12eaf339374613d4381e694ef38169b

SHA512
9432daf045bac3e322b1797f49afe50f76faf8b7d8db063a1d56578016c813881af3324e2529032a8644a04b58ccc9d2c363bf92b56115f06b9eefebfab08180

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21562\_bz2.pyd

Filesize
84KB

MD5
fc0d862a854993e0e51c00dee3eec777

SHA1
20203332c6f7bd51f6a5acbbc9f677c930d0669d

SHA256
e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863

SHA512
b3c2ade15cc196e687e83dd8d21ce88b83c8137a83cfc20bc8f2c8f3ab72643ef7ca08e1dc23de0695f508ba0080871956303ac30f92ab865f3e4249d4d65c2f

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21562\_ssl.pyd

Filesize
150KB

MD5
84dea8d0acce4a707b094a3627b62eab

SHA1
d45dda99466ab08cc922e828729d0840ae2ddc18

SHA256
dcf6b3ff84b55c3859d0f176c4ce6904c0d7d4643a657b817c6322933dbf82f6

SHA512
fdaa7eb10f8bf7b42a5c9691f600eff48190041a8b28a5dab977170db717fff58dd0f64b02ca30d274552ff30ee02a6577f1465792cf6760366c2588bf373108

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21562\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI21562\select.pyd

Filesize
26KB

MD5
a2ab334e18222738dcb05bf820725938

SHA1
2f75455a471f95ac814b8e4560a023034480b7b5

SHA256
7ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7

SHA512
72e891d1c7e5ea44a569283b5c8bd8c310f2ee3d3cc9c25c6a7d7d77a62cb301c822c833b0792c3163cf0b0d6272da2f667e6bc74b07ed7946082433f77d9679

Download Submit