Overview
overview
10Static
static
10e64b687735...eb.exe
windows7-x64
8e64b687735...eb.exe
windows10-2004-x64
8e65dc6f84e...10.exe
windows7-x64
10e65dc6f84e...10.exe
windows10-2004-x64
10e67e28bf49...ac.exe
windows7-x64
10e67e28bf49...ac.exe
windows10-2004-x64
10e699919d5d...ad.exe
windows7-x64
3e699919d5d...ad.exe
windows10-2004-x64
3e70b65e1d8...21.exe
windows7-x64
10e70b65e1d8...21.exe
windows10-2004-x64
10e7193d3473...84.exe
windows7-x64
10e7193d3473...84.exe
windows10-2004-x64
10e740e379c5...b9.exe
windows7-x64
10e740e379c5...b9.exe
windows10-2004-x64
10e751c36e12...39.exe
windows7-x64
1e751c36e12...39.exe
windows10-2004-x64
1e7573bcf85...a1.exe
windows7-x64
7e7573bcf85...a1.exe
windows10-2004-x64
7e787228874...9b.exe
windows7-x64
10e787228874...9b.exe
windows10-2004-x64
10e80000db8c...4b.exe
windows7-x64
10e80000db8c...4b.exe
windows10-2004-x64
10e82aaf456a...e7.exe
windows7-x64
10e82aaf456a...e7.exe
windows10-2004-x64
10e864953c3a...53.exe
windows7-x64
10e864953c3a...53.exe
windows10-2004-x64
10e8686658e2...12.exe
windows7-x64
3e8686658e2...12.exe
windows10-2004-x64
3e8add32344...f4.exe
windows7-x64
10e8add32344...f4.exe
windows10-2004-x64
10e8cdbe10bd...14.exe
windows7-x64
10e8cdbe10bd...14.exe
windows10-2004-x64
10Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:18
Behavioral task
behavioral1
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral12
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral26
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral30
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
e8cdbe10bd3316f1f52cfd57c431f914.exe
Resource
win7-20241010-en
windows7-x64
General
-
Target
e64b687735f08d83a710e6e493346feb.exe
-
Size
228KB
-
MD5
e64b687735f08d83a710e6e493346feb
-
SHA1
42330b4138ce8d74ddf94ccde3cf56678aea4c78
-
SHA256
c5527f31480ac48e227122ccc4239db78bf3094bbbba6f6e1dd6c30e788ac7ae
-
SHA512
f51fb52208429fc9b97881f23d34145bf06a9526827c1ce19240fbf21b1627d0d9b6012584c98ce432a72470fcf33a7e3ec344085f1c83822f29f6accb8846c1
-
SSDEEP
6144:RPTRtufdY7vzXpjYgV53GUEMlqJ8eFNL++y:MG7vzZXW+4NH
Malware Config
Signatures
-
pid Process 2948 powershell.exe 2680 powershell.exe 1284 powershell.exe 2108 powershell.exe -
Deletes itself 1 IoCs
pid Process 1380 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 8 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1380 cmd.exe 2264 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1620 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2264 PING.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2108 powershell.exe 2948 powershell.exe 2680 powershell.exe 2340 powershell.exe 1284 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2628 e64b687735f08d83a710e6e493346feb.exe Token: SeDebugPrivilege 2108 powershell.exe Token: SeDebugPrivilege 2948 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 2340 powershell.exe Token: SeIncreaseQuotaPrivilege 1692 wmic.exe Token: SeSecurityPrivilege 1692 wmic.exe Token: SeTakeOwnershipPrivilege 1692 wmic.exe Token: SeLoadDriverPrivilege 1692 wmic.exe Token: SeSystemProfilePrivilege 1692 wmic.exe Token: SeSystemtimePrivilege 1692 wmic.exe Token: SeProfSingleProcessPrivilege 1692 wmic.exe Token: SeIncBasePriorityPrivilege 1692 wmic.exe Token: SeCreatePagefilePrivilege 1692 wmic.exe Token: SeBackupPrivilege 1692 wmic.exe Token: SeRestorePrivilege 1692 wmic.exe Token: SeShutdownPrivilege 1692 wmic.exe Token: SeDebugPrivilege 1692 wmic.exe Token: SeSystemEnvironmentPrivilege 1692 wmic.exe Token: SeRemoteShutdownPrivilege 1692 wmic.exe Token: SeUndockPrivilege 1692 wmic.exe Token: SeManageVolumePrivilege 1692 wmic.exe Token: 33 1692 wmic.exe Token: 34 1692 wmic.exe Token: 35 1692 wmic.exe Token: SeIncreaseQuotaPrivilege 1692 wmic.exe Token: SeSecurityPrivilege 1692 wmic.exe Token: SeTakeOwnershipPrivilege 1692 wmic.exe Token: SeLoadDriverPrivilege 1692 wmic.exe Token: SeSystemProfilePrivilege 1692 wmic.exe Token: SeSystemtimePrivilege 1692 wmic.exe Token: SeProfSingleProcessPrivilege 1692 wmic.exe Token: SeIncBasePriorityPrivilege 1692 wmic.exe Token: SeCreatePagefilePrivilege 1692 wmic.exe Token: SeBackupPrivilege 1692 wmic.exe Token: SeRestorePrivilege 1692 wmic.exe Token: SeShutdownPrivilege 1692 wmic.exe Token: SeDebugPrivilege 1692 wmic.exe Token: SeSystemEnvironmentPrivilege 1692 wmic.exe Token: SeRemoteShutdownPrivilege 1692 wmic.exe Token: SeUndockPrivilege 1692 wmic.exe Token: SeManageVolumePrivilege 1692 wmic.exe Token: 33 1692 wmic.exe Token: 34 1692 wmic.exe Token: 35 1692 wmic.exe Token: SeIncreaseQuotaPrivilege 2876 wmic.exe Token: SeSecurityPrivilege 2876 wmic.exe Token: SeTakeOwnershipPrivilege 2876 wmic.exe Token: SeLoadDriverPrivilege 2876 wmic.exe Token: SeSystemProfilePrivilege 2876 wmic.exe Token: SeSystemtimePrivilege 2876 wmic.exe Token: SeProfSingleProcessPrivilege 2876 wmic.exe Token: SeIncBasePriorityPrivilege 2876 wmic.exe Token: SeCreatePagefilePrivilege 2876 wmic.exe Token: SeBackupPrivilege 2876 wmic.exe Token: SeRestorePrivilege 2876 wmic.exe Token: SeShutdownPrivilege 2876 wmic.exe Token: SeDebugPrivilege 2876 wmic.exe Token: SeSystemEnvironmentPrivilege 2876 wmic.exe Token: SeRemoteShutdownPrivilege 2876 wmic.exe Token: SeUndockPrivilege 2876 wmic.exe Token: SeManageVolumePrivilege 2876 wmic.exe Token: 33 2876 wmic.exe Token: 34 2876 wmic.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2552 2628 e64b687735f08d83a710e6e493346feb.exe 30 PID 2628 wrote to memory of 2552 2628 e64b687735f08d83a710e6e493346feb.exe 30 PID 2628 wrote to memory of 2552 2628 e64b687735f08d83a710e6e493346feb.exe 30 PID 2628 wrote to memory of 2108 2628 e64b687735f08d83a710e6e493346feb.exe 32 PID 2628 wrote to memory of 2108 2628 e64b687735f08d83a710e6e493346feb.exe 32 PID 2628 wrote to memory of 2108 2628 e64b687735f08d83a710e6e493346feb.exe 32 PID 2628 wrote to memory of 2948 2628 e64b687735f08d83a710e6e493346feb.exe 34 PID 2628 wrote to memory of 2948 2628 e64b687735f08d83a710e6e493346feb.exe 34 PID 2628 wrote to memory of 2948 2628 e64b687735f08d83a710e6e493346feb.exe 34 PID 2628 wrote to memory of 2680 2628 e64b687735f08d83a710e6e493346feb.exe 36 PID 2628 wrote to memory of 2680 2628 e64b687735f08d83a710e6e493346feb.exe 36 PID 2628 wrote to memory of 2680 2628 e64b687735f08d83a710e6e493346feb.exe 36 PID 2628 wrote to memory of 2340 2628 e64b687735f08d83a710e6e493346feb.exe 38 PID 2628 wrote to memory of 2340 2628 e64b687735f08d83a710e6e493346feb.exe 38 PID 2628 wrote to memory of 2340 2628 e64b687735f08d83a710e6e493346feb.exe 38 PID 2628 wrote to memory of 1692 2628 e64b687735f08d83a710e6e493346feb.exe 40 PID 2628 wrote to memory of 1692 2628 e64b687735f08d83a710e6e493346feb.exe 40 PID 2628 wrote to memory of 1692 2628 e64b687735f08d83a710e6e493346feb.exe 40 PID 2628 wrote to memory of 2876 2628 e64b687735f08d83a710e6e493346feb.exe 43 PID 2628 wrote to memory of 2876 2628 e64b687735f08d83a710e6e493346feb.exe 43 PID 2628 wrote to memory of 2876 2628 e64b687735f08d83a710e6e493346feb.exe 43 PID 2628 wrote to memory of 2132 2628 e64b687735f08d83a710e6e493346feb.exe 45 PID 2628 wrote to memory of 2132 2628 e64b687735f08d83a710e6e493346feb.exe 45 PID 2628 wrote to memory of 2132 2628 e64b687735f08d83a710e6e493346feb.exe 45 PID 2628 wrote to memory of 1284 2628 e64b687735f08d83a710e6e493346feb.exe 47 PID 2628 wrote to memory of 1284 2628 e64b687735f08d83a710e6e493346feb.exe 47 PID 2628 wrote to memory of 1284 2628 e64b687735f08d83a710e6e493346feb.exe 47 PID 2628 wrote to memory of 1620 2628 e64b687735f08d83a710e6e493346feb.exe 49 PID 2628 wrote to memory of 1620 2628 e64b687735f08d83a710e6e493346feb.exe 49 PID 2628 wrote to memory of 1620 2628 e64b687735f08d83a710e6e493346feb.exe 49 PID 2628 wrote to memory of 1380 2628 e64b687735f08d83a710e6e493346feb.exe 51 PID 2628 wrote to memory of 1380 2628 e64b687735f08d83a710e6e493346feb.exe 51 PID 2628 wrote to memory of 1380 2628 e64b687735f08d83a710e6e493346feb.exe 51 PID 1380 wrote to memory of 2264 1380 cmd.exe 53 PID 1380 wrote to memory of 2264 1380 cmd.exe 53 PID 1380 wrote to memory of 2264 1380 cmd.exe 53 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2552 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe"C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe"2⤵
- Views/modifies file attributes
PID:2552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2132
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1620
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\e64b687735f08d83a710e6e493346feb.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2264
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD55a8d1b097566742f16ad626e193c530d
SHA1036f0372d4deb0f8bcd69ccfc64bc7c0ac817b79
SHA2566a4ca9cd2134942c2ae7db279675d24bffb858c40ae7b767d3619d773e6a68e4
SHA5120918aa3c7085f87306f912b941194aef60a3def530e353a411172f402f832ab29234e690b7064b693036019cbd664a275563a06b944885becee4876aea3fb420