da25603a4f0814e69588e90d66544d0a5287eb8460f4bf2967aa2f3ef5c1059f

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3120-1347-0x0000000000400000-0x0000000000459000-memory.exe
Size

356KB
MD5

bb12aac9fdd1a898bc05827e2867067f
SHA1

f751b89cd279d1dcab50412fb762bb8e9cb0cf03
SHA256

da25603a4f0814e69588e90d66544d0a5287eb8460f4bf2967aa2f3ef5c1059f
SHA512

c9591f6c70f713e12e505d6d93a24c7362f6e106f298fb8e8e063501fa4f2698212951a7333cb69665c71a4f2525f752a8457cef97eb8a67a40622f663d3ad02
SSDEEP

6144:OHJ8d1/w5KA81IJ8GpF6nuTmOOUpAhhW+fekiUmrHVAyfvSkj9qJu:OyjYKkJj6GmZUpghW+oUmBAyfKosJ

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000016593-5.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1952	3120-1347-0x0000000000400000-0x0000000000459000-memory.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016593-5.dat	upx
behavioral1/memory/1952-8-0x0000000074670000-0x00000000746D9000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3120-1347-0x0000000000400000-0x0000000000459000-memory.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	3120-1347-0x0000000000400000-0x0000000000459000-memory.exe

C:\Users\Admin\AppData\Local\Temp\3120-1347-0x0000000000400000-0x0000000000459000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\3120-1347-0x0000000000400000-0x0000000000459000-memory.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\VORHPBAB-Admin\vbsqlite3.dll

Filesize
161KB

MD5
073a17b6cfb1112c6c838b2fba06a657

SHA1
a54bb22489eaa8c52eb3e512aee522320530b0be

SHA256
dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab

SHA512
5bc8307350bd8ba09fa9eedddc62f1dba65db62eb09ae64e0adff4dfad0937dbec5b621f294f5980bf77033faac3bfe200945c0280606915ee9a82d34a003b9e

Download Submit
memory/1952-8-0x0000000074670000-0x00000000746D9000-memory.dmp

Filesize
420KB

Download