Analysis

  • max time kernel
    37s
  • max time network
    87s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 23:02

General

  • Target

    d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe

  • Size

    1.5MB

  • MD5

    0afecbd0a3caa90bf507df6162b8b89e

  • SHA1

    ef4b5c7acfd436259b158cd341ad82192218dfcd

  • SHA256

    d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36

  • SHA512

    9779c28888c00dc99707e7a40c0a16ff7560bc75ba817bb8273395fdcbd5410b0ce07e89f55b793141e0fb912ae0f05392305219810a49ff9d9619a02911e2ee

  • SSDEEP

    24576:+2njEFW/SL0drqNWhzImvifsfEjK7PKPP+EbHMHus3ufK7fura6tuo4x527g:JngrwdrqIhzImvi0sFPP+EB1jtuF52k

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe
    "C:\Users\Admin\AppData\Local\Temp\d0b80b82653285a86d54ecbdbb3dfa5a4eedf580288cdcdc77717c1548c26f36.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer.exe
      "C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer.exe" --qsc --pw ""
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1144

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\temp\TeamViewer\Version4\SAS.exe

          Filesize

          53KB

          MD5

          bf3bcd752bdabfa1f1e84b7462738103

          SHA1

          34cb8ea7d47467cace271e03b7869f37b0ecb30a

          SHA256

          90fe790e189c384f2ab82958057f91fdf40888c2ed3c0471bd7b85d5b36c7810

          SHA512

          6d5362c4d354319845f4522e0d1132c32a6779efc4c013c8c7bd489fddf39cbb5dfb72b135487b660d156d7774e5be4acc03c3fcecdb6dabcfad12630a3f5955

        • C:\Users\Admin\temp\TeamViewer\Version4\TeamViewer.ini

          Filesize

          542B

          MD5

          78a6846fe5b1a88197638158ff477b46

          SHA1

          72d8fdd39917b2523a250da57b455eac83bc2574

          SHA256

          5d73a02cce54639cb68303515b551e7203151fb3cb6db7eba6094a4a381a7534

          SHA512

          1f0817267d3a077bba1e66da2658045f1f65e00ac0a6c8c6179a27dfc615d233c03bf6acc2c3cd87b78d4014e8a9af84bcbe9a2c88cd98ec7ab14909f42d93b3

        • C:\Users\Admin\temp\TeamViewer\Version4\logo.bmp

          Filesize

          39KB

          MD5

          36b0c93bfad92bafa45960e6386b0cec

          SHA1

          ef6f2e3c3ab2038e16a000bcdb341a9e94e9cdb2

          SHA256

          01742bf0894f1f86bcd4200d8d26b254248e99f9d656993b93bd3b5c553b0cc0

          SHA512

          6ac361bc1b556156123d5d8720992a7522600ebf883c6747deb560f9ebfd4746640c6f8d104ffcf71f7c6bf5832145f6921ca38e8ed685d852bee9c10db9ebc6

        • C:\Users\Admin\temp\TeamViewer\Version4\tv.dll

          Filesize

          96KB

          MD5

          5a3ebc8826fb07feb11f48a86a1eaed1

          SHA1

          de801f5968c29a7078740e45aa340b862ec70c55

          SHA256

          28f18a801edc53df266168bb47f8d9ff3b98cbb6e2c84fa042c7591213a6f3f1

          SHA512

          edab11c5740799d58fdd0799d0f86c50e0ad53d32904da5d86fc81a13da32a454085e2d5a05473b771580fd13ba1fb64cd0d6794244f3369a154ff5ed52d669b

        • \Users\Admin\AppData\Local\Temp\nsj9BC4.tmp\Base64.dll

          Filesize

          456KB

          MD5

          9459a28dbb2752d59eaa8fbb5cf8c982

          SHA1

          4ad7eb230cf6d05df967037225fa19dd385bf7cb

          SHA256

          4688dcd01db816485a770cb8fc047fef9a408f3dbec5a2c83752fee115ce6963

          SHA512

          7dff6414f4215aa4c7a168158b4ac5dd422c7dd35c6af58bce658c6bf9bf5a3545a5ee0db5f5d47a17c7ae53cb54551b98b492137e36c73e684b2041d775cd97

        • \Users\Admin\AppData\Local\Temp\nsj9BC4.tmp\System.dll

          Filesize

          10KB

          MD5

          cfbae93f361e2b430743e423709a483f

          SHA1

          9d31546592a9e6817025cc5026fee769e9a6c015

          SHA256

          0f4aac375087f0a5df393d7463bd462193008922136a2aba8619736223ba7add

          SHA512

          485bc9c83087a1a6f48a5508ee390384c2db93b9d50c295280337dad78b47f65aaa0caea8d6d23ef25f86b73cd2e724cb88a738f6b53037e47225c6522f912b3

        • \Users\Admin\AppData\Local\Temp\nsj9BC4.tmp\TvGetVersion.dll

          Filesize

          6KB

          MD5

          409b195108f014b032eb5dd36ca17a12

          SHA1

          4544950c7c081fb0aeba7971bcf46f2761430f4e

          SHA256

          52b487ff38814953eae017f2751f8e2fed7284f6faa250266cbd8d749547695f

          SHA512

          fe981570f6642933c36bbd7b1fef0d7e469600d44ea9e3b94ad94e1b6bb81c98c74c0d1c8673385443daaa3750de4e7eedc49aaf38ccc56c09e2d141e27068db

        • \Users\Admin\AppData\Local\Temp\nsj9BC4.tmp\UAC.dll

          Filesize

          13KB

          MD5

          7191bf2f751c79e50386b87c458ed2da

          SHA1

          30df71f1945f0ece8d396042dba84d92f84dbfb6

          SHA256

          45de80c4ef75ac01fdfca02a0c05c090311cb65b0f52b61e2307494d643466df

          SHA512

          121143369c5edd732a513c884fa90d0ffc03f3966c46f8feccad09591295890de61dec7872e6fd6cd03ae132287bd1dad44d74b45fc8e623a0fa4a647510ca91

        • \Users\Admin\temp\TeamViewer\Version4\TeamViewer.exe

          Filesize

          3.7MB

          MD5

          e15725a55477504ac78a4760b86c7ea3

          SHA1

          4ce4ff8d2417c10793c072b1534f4e4a42d10ba6

          SHA256

          81f725fcf5faace66c3bc3ef72468bd80597b5f4474a4441bce4c665e4dac6d4

          SHA512

          0ce320063a646e81e9750b92e21f91e6a74ab9b296a2163c2e51dbd432b0aac11859b63904dc22abe29572eafa9eac9c5f574de42f9206f577fc6a22b137013f

        • memory/1144-89-0x0000000002160000-0x0000000002161000-memory.dmp

          Filesize

          4KB

        • memory/1144-91-0x0000000002160000-0x0000000002161000-memory.dmp

          Filesize

          4KB

        • memory/1924-65-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

        • memory/1924-46-0x0000000010000000-0x00000000100A0000-memory.dmp

          Filesize

          640KB

        • memory/1924-0-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB