Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 19:15

General

  • Target

    e96273076da36e229870ea1f812eba3a6300796e55bcc25c9fa85e39bf7632fcN.exe

  • Size

    13KB

  • MD5

    224c306b78a6e3fb7d042c3be3888790

  • SHA1

    048d839a99a4d8228a7fde54fe2b95e8c4e09999

  • SHA256

    e96273076da36e229870ea1f812eba3a6300796e55bcc25c9fa85e39bf7632fc

  • SHA512

    44d8de49fef4d9a95123b0c2ef4cf9529f133b142c8cf875a5cd2fd6e5137239ff6e6c6de45ea6a8872ed308243dbfd822f64937e38eeb94d4423fe09cd21541

  • SSDEEP

    384:tv+t/QgBssNSvNSV+EVeFuKk/RetkMHvLYYx3ppg:t2h/EEQ0VKkJedYH

Malware Config

Signatures

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e96273076da36e229870ea1f812eba3a6300796e55bcc25c9fa85e39bf7632fcN.exe
    "C:\Users\Admin\AppData\Local\Temp\e96273076da36e229870ea1f812eba3a6300796e55bcc25c9fa85e39bf7632fcN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\videodrv.exe
      C:\Windows\videodrv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1636

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\eml.tmp

          Filesize

          895B

          MD5

          91c3cdc1653ba5675ea4df74281f469c

          SHA1

          114a183104130407751193c8c4423e72af2bd8ca

          SHA256

          4f0839ef8ef74df631cd7a0d83228c90810f420092d3cafc8e68b48c7a17f335

          SHA512

          4f764c4e4934c8d467208ea25fb557d76d8ceea9093863718959ffabdd8b979bc46927d26b033f1b861c144e0cb804c946a0b3fce6dd39961cb415b18fc0e0e6

        • C:\Windows\videodrv.exe

          Filesize

          13KB

          MD5

          224c306b78a6e3fb7d042c3be3888790

          SHA1

          048d839a99a4d8228a7fde54fe2b95e8c4e09999

          SHA256

          e96273076da36e229870ea1f812eba3a6300796e55bcc25c9fa85e39bf7632fc

          SHA512

          44d8de49fef4d9a95123b0c2ef4cf9529f133b142c8cf875a5cd2fd6e5137239ff6e6c6de45ea6a8872ed308243dbfd822f64937e38eeb94d4423fe09cd21541

        • memory/1636-15-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1636-16-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1636-102-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1636-127-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1636-128-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/1636-129-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/3056-0-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/3056-14-0x0000000000400000-0x0000000000479000-memory.dmp

          Filesize

          484KB

        • memory/3056-13-0x0000000000220000-0x0000000000299000-memory.dmp

          Filesize

          484KB