Analysis

  • max time kernel
    57s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-12-2024 14:36

General

  • Target

    FC8E43EC21BE9047/lbg64.exe

  • Size

    49KB

  • MD5

    8ff61e4156c10b085e0c2233f24e8501

  • SHA1

    69d50a8efd73c619aa36113ec04368db83d9b331

  • SHA256

    3552dda80bd6875c1ed1273ca7562c9ace3de2f757266dae70f60bf204089a4a

  • SHA512

    dbde74b89d498d708215ddfdc9a2a38cb27be931c9fe2d5965aba3c31482a0efbe39913ed17eabe5eae3b5efc9cb369589784e7d9ce5b2e89505c10406038249

  • SSDEEP

    768:9pZt6fz03gUYxTSGCoTrxTjA+xqCkEiAOPZAzEZoo6Czcit6OjeB6:jpQRNSGCo64OxAgZUCcicvB6

Malware Config

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FC8E43EC21BE9047\lbg64.exe
    "C:\Users\Admin\AppData\Local\Temp\FC8E43EC21BE9047\lbg64.exe"
    1⤵
    • Deletes itself
    • Drops startup file
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • F:\Restore-My-Files.txt

    Filesize

    6KB

    MD5

    74a77bd81fa83b32b595eafa20c978ec

    SHA1

    5ce7e2079a61d012d4839a84eb7bb329651a2ead

    SHA256

    49cc31e84e5f3cf75de5d5f58f62ac6c43d9dca726dfc750593129b730a56616

    SHA512

    71accd7c7e1060a696718a4f11a7e04c2f6c16b05dfe4fa12e80878d703a403b7d33861b1315436f881fba37e1a0c3ae2aefc09499f5e7b04b2c582ba0e635e4

  • memory/1916-4-0x000007FEFDC50000-0x000007FEFDD2B000-memory.dmp

    Filesize

    876KB

  • memory/1916-10540-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-6-0x000007FEFD0A0000-0x000007FEFD207000-memory.dmp

    Filesize

    1.4MB

  • memory/1916-2-0x0000000077010000-0x000000007712F000-memory.dmp

    Filesize

    1.1MB

  • memory/1916-3-0x000007FEFD380000-0x000007FEFD3EC000-memory.dmp

    Filesize

    432KB

  • memory/1916-0-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-8-0x000007FEFDAE0000-0x000007FEFDBB7000-memory.dmp

    Filesize

    860KB

  • memory/1916-7-0x000007FEFD760000-0x000007FEFD963000-memory.dmp

    Filesize

    2.0MB

  • memory/1916-10-0x000007FEFDEE0000-0x000007FEFEC68000-memory.dmp

    Filesize

    13.5MB

  • memory/1916-4656-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-11-0x0000000077130000-0x000000007722A000-memory.dmp

    Filesize

    1000KB

  • memory/1916-12-0x000007FEFD440000-0x000007FEFD48D000-memory.dmp

    Filesize

    308KB

  • memory/1916-9-0x0000000077230000-0x00000000773D9000-memory.dmp

    Filesize

    1.7MB

  • memory/1916-4662-0x0000000077231000-0x0000000077332000-memory.dmp

    Filesize

    1.0MB

  • memory/1916-5703-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-5704-0x0000000077230000-0x00000000773D9000-memory.dmp

    Filesize

    1.7MB

  • memory/1916-10347-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-10534-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-10536-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-10537-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-10538-0x000000013F0C0000-0x000000013F1E7000-memory.dmp

    Filesize

    1.2MB

  • memory/1916-10541-0x0000000077230000-0x00000000773D9000-memory.dmp

    Filesize

    1.7MB

  • memory/1916-5-0x0000000077231000-0x0000000077332000-memory.dmp

    Filesize

    1.0MB