Analysis
-
max time kernel
37s -
max time network
87s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 23:02
Behavioral task
behavioral1
Sample
d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe
Resource
win7-20240903-en
General
-
Target
d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe
-
Size
1.5MB
-
MD5
0afecbd0a3caa90bf507df6162b8b89e
-
SHA1
ef4b5c7acfd436259b158cd341ad82192218dfcd
-
SHA256
d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36
-
SHA512
9779c28888c00dc99707e7a40c0a16ff7560bc75ba817bb8273395fdcbd5410b0ce07e89f55b793141e0fb912ae0f05392305219810a49ff9d9619a02911e2ee
-
SSDEEP
24576:+2njEFW/SL0drqNWhzImvifsfEjK7PKPP+EbHMHus3ufK7fura6tuo4x527g:JngrwdrqIhzImvi0sFPP+EB1jtuF52k
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1144 TeamViewer.exe -
Loads dropped DLL 11 IoCs
pid Process 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 1144 TeamViewer.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1924-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1924-65-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\QS\SAS.exe TeamViewer.exe File opened for modification C:\Program Files (x86)\QS\SAS.exe TeamViewer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1144 TeamViewer.exe 1144 TeamViewer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1144 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 30 PID 1924 wrote to memory of 1144 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 30 PID 1924 wrote to memory of 1144 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 30 PID 1924 wrote to memory of 1144 1924 d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe"C:\Users\Admin\AppData\Local\Temp\d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer.exe"C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer.exe" --qsc --pw ""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5bf3bcd752bdabfa1f1e84b7462738103
SHA134cb8ea7d47467cace271e03b7869f37b0ecb30a
SHA25690fe790e189c384f2ab82958057f91fdf40888c2ed3c0471bd7b85d5b36c7810
SHA5126d5362c4d354319845f4522e0d1132c32a6779efc4c013c8c7bd489fddf39cbb5dfb72b135487b660d156d7774e5be4acc03c3fcecdb6dabcfad12630a3f5955
-
Filesize
542B
MD578a6846fe5b1a88197638158ff477b46
SHA172d8fdd39917b2523a250da57b455eac83bc2574
SHA2565d73a02cce54639cb68303515b551e7203151fb3cb6db7eba6094a4a381a7534
SHA5121f0817267d3a077bba1e66da2658045f1f65e00ac0a6c8c6179a27dfc615d233c03bf6acc2c3cd87b78d4014e8a9af84bcbe9a2c88cd98ec7ab14909f42d93b3
-
Filesize
39KB
MD536b0c93bfad92bafa45960e6386b0cec
SHA1ef6f2e3c3ab2038e16a000bcdb341a9e94e9cdb2
SHA25601742bf0894f1f86bcd4200d8d26b254248e99f9d656993b93bd3b5c553b0cc0
SHA5126ac361bc1b556156123d5d8720992a7522600ebf883c6747deb560f9ebfd4746640c6f8d104ffcf71f7c6bf5832145f6921ca38e8ed685d852bee9c10db9ebc6
-
Filesize
96KB
MD55a3ebc8826fb07feb11f48a86a1eaed1
SHA1de801f5968c29a7078740e45aa340b862ec70c55
SHA25628f18a801edc53df266168bb47f8d9ff3b98cbb6e2c84fa042c7591213a6f3f1
SHA512edab11c5740799d58fdd0799d0f86c50e0ad53d32904da5d86fc81a13da32a454085e2d5a05473b771580fd13ba1fb64cd0d6794244f3369a154ff5ed52d669b
-
Filesize
456KB
MD59459a28dbb2752d59eaa8fbb5cf8c982
SHA14ad7eb230cf6d05df967037225fa19dd385bf7cb
SHA2564688dcd01db816485a770cb8fc047fef9a408f3dbec5a2c83752fee115ce6963
SHA5127dff6414f4215aa4c7a168158b4ac5dd422c7dd35c6af58bce658c6bf9bf5a3545a5ee0db5f5d47a17c7ae53cb54551b98b492137e36c73e684b2041d775cd97
-
Filesize
10KB
MD5cfbae93f361e2b430743e423709a483f
SHA19d31546592a9e6817025cc5026fee769e9a6c015
SHA2560f4aac375087f0a5df393d7463bd462193008922136a2aba8619736223ba7add
SHA512485bc9c83087a1a6f48a5508ee390384c2db93b9d50c295280337dad78b47f65aaa0caea8d6d23ef25f86b73cd2e724cb88a738f6b53037e47225c6522f912b3
-
Filesize
6KB
MD5409b195108f014b032eb5dd36ca17a12
SHA14544950c7c081fb0aeba7971bcf46f2761430f4e
SHA25652b487ff38814953eae017f2751f8e2fed7284f6faa250266cbd8d749547695f
SHA512fe981570f6642933c36bbd7b1fef0d7e469600d44ea9e3b94ad94e1b6bb81c98c74c0d1c8673385443daaa3750de4e7eedc49aaf38ccc56c09e2d141e27068db
-
Filesize
13KB
MD57191bf2f751c79e50386b87c458ed2da
SHA130df71f1945f0ece8d396042dba84d92f84dbfb6
SHA25645de80c4ef75ac01fdfca02a0c05c090311cb65b0f52b61e2307494d643466df
SHA512121143369c5edd732a513c884fa90d0ffc03f3966c46f8feccad09591295890de61dec7872e6fd6cd03ae132287bd1dad44d74b45fc8e623a0fa4a647510ca91
-
Filesize
3.7MB
MD5e15725a55477504ac78a4760b86c7ea3
SHA14ce4ff8d2417c10793c072b1534f4e4a42d10ba6
SHA25681f725fcf5faace66c3bc3ef72468bd80597b5f4474a4441bce4c665e4dac6d4
SHA5120ce320063a646e81e9750b92e21f91e6a74ab9b296a2163c2e51dbd432b0aac11859b63904dc22abe29572eafa9eac9c5f574de42f9206f577fc6a22b137013f