Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 16:43
Static task
static1
Behavioral task
behavioral1
Sample
eagleget-2-1-6-50.exe
Resource
win7-20241010-en
General
-
Target
eagleget-2-1-6-50.exe
-
Size
10.0MB
-
MD5
e96dd956bc2159ff1d073876ef5d4e58
-
SHA1
a0da0d7c8394d646eb5a0f64be14397235f22704
-
SHA256
14636b7fc900e2be3fee5abb409e3b7a3cdf5a99107bf6d7dcbcce4b26ee0d34
-
SHA512
c2334b9c666174d38213c1cd84a8f2f9fbfbeea8e18f7fdf7e0b6bab70377e7d1a8f01fe45688bcbfcc2bb85933aa97a829c1feb94ede874b1426dd320080806
-
SSDEEP
196608:Mem6/gb2N3s9m35DylYLan8CmD5zpX9o38vR/dnG0sb9iMly9ssSGz8EQgCPhtv:MelYyVYm3RLaQ5zpNq8NdnExiMw+P4QD
Malware Config
Signatures
-
Detects Strela Stealer payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000016d46-11.dat family_strela -
Strela family
-
Executes dropped EXE 1 IoCs
pid Process 1276 eagleget-2-1-6-50.tmp -
Loads dropped DLL 4 IoCs
pid Process 1944 eagleget-2-1-6-50.exe 1276 eagleget-2-1-6-50.tmp 1276 eagleget-2-1-6-50.tmp 1276 eagleget-2-1-6-50.tmp -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eagleget-2-1-6-50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eagleget-2-1-6-50.tmp -
Kills process with taskkill 1 IoCs
pid Process 2628 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2628 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1276 1944 eagleget-2-1-6-50.exe 30 PID 1944 wrote to memory of 1276 1944 eagleget-2-1-6-50.exe 30 PID 1944 wrote to memory of 1276 1944 eagleget-2-1-6-50.exe 30 PID 1944 wrote to memory of 1276 1944 eagleget-2-1-6-50.exe 30 PID 1276 wrote to memory of 2628 1276 eagleget-2-1-6-50.tmp 31 PID 1276 wrote to memory of 2628 1276 eagleget-2-1-6-50.tmp 31 PID 1276 wrote to memory of 2628 1276 eagleget-2-1-6-50.tmp 31 PID 1276 wrote to memory of 2628 1276 eagleget-2-1-6-50.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\eagleget-2-1-6-50.exe"C:\Users\Admin\AppData\Local\Temp\eagleget-2-1-6-50.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\is-F49HI.tmp\eagleget-2-1-6-50.tmp"C:\Users\Admin\AppData\Local\Temp\is-F49HI.tmp\eagleget-2-1-6-50.tmp" /SL5="$30148,9993427,175104,C:\Users\Admin\AppData\Local\Temp\eagleget-2-1-6-50.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "net_updater32.exe"3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ef9ed169ba900bc5250d0210d25619e3
SHA1d333ee23b4441e7da0109886159f7c9e78819c5c
SHA256806f42fddd09b24993ec053e6fdcae023e4833b371590843a498aacac20b8c7c
SHA512042e7fef639b74e421ab456e41301dedd1a91f29795b5594eea89ee95ff6c44b3f72936e639f8671bba3874fb6f536c7ef01bc878c5e3a1bdc1e73ae2f716267
-
Filesize
2KB
MD58dd4f9f2c22073544694eca39c4f305d
SHA1f7944cd8aa4f4b5233867dbdcea034a8d4be69e2
SHA2560f6e9827ef681b88722d2013ae44fe5f8eeeaf22b6fe64904ecd0852de8197c8
SHA5121c8708c77e8e61659ad7a903a4b5431e72532645486ca62e9b84d42f2e1fce2ebf07d17b64241656e08f32d766843dea6bc40fe7e8ff6e010201de8860a0d189
-
Filesize
204B
MD5b780d58e26ddf76733743501d00123d4
SHA1594b7196378628bcc7107e8186e2f2f6da07ac0b
SHA2568a6026306c1774d027022b3ee600c34b296ab8135f46c872d74c734baa239eac
SHA5128691a1c2a00311f31224fee23803a91bc2a7597aa2ac928cfc43291b7c6cfd89bce7f7fd60d8448603b5c441ff2706f9686e1fa71c56041d0c5377eb1e14ba5c
-
Filesize
103B
MD52e9c0f6a83184050751c5cb0dfae2397
SHA1f1c3e7a900db6572ac0940b833b1ec30141bc17d
SHA256686967328122f54acd92f85f6c162d42a8f607148f511ec4f7ab41010fc7db66
SHA51203256bfcf0df9e390e1cfa1b4571aece489270d6c72f231db1c0a1d22b9c181a89fb2865810af217956b052eb47f34d5636edef4606074f607203358370ffc90
-
Filesize
1KB
MD566deff37283bca24ea963ae3a3963b38
SHA16c2410db0d9d77ed8019c01d68cb9fcdfa93b330
SHA256d9f0859f6a5648b0a9060200cc9a7534161e1b22844f631766e4e3540090790a
SHA512706a5f2b297694f48f623ba3ab9b0cbadd4a48be9d3b619ec76cf0aadf1638134d65a8de492b869573c136665778bfe86133cb9973d47f29f95683c4bb83faa6
-
Filesize
4KB
MD5212afbaedaa752a5e8957a609a0ae9f1
SHA173e210e0fdd3ac797e6b30bb57a17f2ddd195002
SHA256d95a68be5109a23db0d0dff20ba3453ca69d39f48f2ae996255b84557a96881b
SHA512b83e22c50f011f2bb42ea6936bd2b776d9371c933119a7aa19181cb2a3f7e050478c8e679410aea39ecc750b408ecf55fd927bad1234fa041a89ebd737ac5061
-
Filesize
351B
MD53f5325a8962d480ccb89be73e7e054b5
SHA1319e2f9e1c6c681f79265f6b24606574cbbeebbc
SHA256ecfe768ec009c8cb24edb1dd3cfe8a8e8a583fcfc90ec90442ce1c8d59241cdc
SHA5125994ba26c4fdc4ae3a94af2e0e48e3e173c8094fa8b069bfa47b1403ba8283e2ee312f49c308eed2f0d9d244373577244c6d8e4495d4f91f8b6597fff90b4db1
-
Filesize
1KB
MD58277d98e048ba1adf360d63622f5b0bf
SHA10bdc270cd963b2b34e919250455062f782052a47
SHA2569a004daa7630d4916c962e681f1a1f95db3ff476fe82272dc937f7ac200683a2
SHA5125b8a354efe4073473a92118027b06d1fe599a422f395fbfa17ce0bf5c3a0cb94c7bfadb1c324e66829ad478e1561200259d32d05514fbaa22f6bbc3a90a8579a
-
Filesize
11KB
MD5e92f3fbf3876c4044722fd975281b3ff
SHA1d92877cad872663616a48f25af291e8bffb246aa
SHA25631137ad0ef19381e1778eb89b6cb9f70a9ee5244ad943ad494e1e57b18b48ab7
SHA51246fdb373fe54ecf762adcba6a08a0e2e67080d97931fe1407d4f60b74921d9ef7d38ec7104271805635a015ba5230a09e16de60010aecc5c404ae376efddfac7
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
35KB
MD50177746573eed407f8dca8a9e441aa49
SHA16b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA256a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
SHA512d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
-
Filesize
1010KB
MD5192c98cb51f39be053ad5c7e029e75f8
SHA12fbb285edc39d51a0e56a7ef996c9f67c4b1a015
SHA256a2ef6b8fbf44bc77631d5635b8abedf90db5903b94618753168f5a904ebc5f60
SHA5124b810f8861d037e3581fadb17a7a22f29648eb651d9bbd2827167fdce94975a5eef25d899009286ce6636a59732b6728510b6f9e151ea2d026f764dd1fd5bf2e
-
Filesize
1.2MB
MD5eb42e5720e09cd014694a22c86929f5e
SHA1b619dccd5e1deb090d8eae6c6bac5e5dae91fdfb
SHA2564dc2d414277e497490d2009f370051298bccaa649d0a335b064269a0bb9bbbf3
SHA5124f5ea3e32f7da75799b8067351a860f6c840dba8108c92d34d4be7d6b811140e6b2dd161ba4bd90df77dff41b74e1e85b536b3776cadb656018a1914acc3ee2f