Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:25

General

  • Target

    0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791.exe

  • Size

    3.4MB

  • MD5

    c492e8c8507de24047598128c068f9b5

  • SHA1

    0102f531e7c1cd9d58280b7409bd5861740b1ea6

  • SHA256

    0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791

  • SHA512

    15edf4eb649784450e8ffbd726888d1b032074b206be7d328bfb35135704eaec50fa1807b3ab608fd3412d42b06b896afb37e5b96f51d1ce08b5e24e77951c72

  • SSDEEP

    98304:hRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/i7:hkj8NBFwxpNOuk2v7

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791.exe
    "C:\Users\Admin\AppData\Local\Temp\0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Users\Admin\AppData\Local\Temp\4870uvlbiPR.exe
      "C:\Users\Admin\AppData\Local\Temp\4870uvlbiPR.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDBhY2UwODYyOGZlYzFjOTQ2OTdjNWIwZTZiZWQ2ZWExYTk1NTc3MmZiNDkzYTUyY2RlMTQ0ZTY2MmYyMTQ3OTEuZXhl
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1148
        • C:\Windows\system32\sc.exe
          sc stop "SysMain"
          4⤵
          • Launches sc.exe
          PID:2604
        • C:\Windows\system32\sc.exe
          sc config "SysMain" start=disabled
          4⤵
          • Launches sc.exe
          PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\4870uvlbiPR.exe

    Filesize

    3.5MB

    MD5

    f2db00f6f2146d0d7c5a02ba8419328d

    SHA1

    68f91e8a64bd3db9170b3bc28277270a2ad3ee32

    SHA256

    24eebfd6484cd4acd2c1a33d273683b456acd6d954ded0119feb86e16c0a0216

    SHA512

    81954e8741aad189990dcd7c776b9c5b33749feefdb6c79e4446c93c00a916cb235ab6b16a69f4dbd6d4312765b8160e056376d99ed3b1253dec7616d3fffd0c

  • memory/816-6-0x0000000000670000-0x0000000000674000-memory.dmp

    Filesize

    16KB

  • memory/816-7-0x0000000000690000-0x0000000000696000-memory.dmp

    Filesize

    24KB

  • memory/816-3-0x0000000000640000-0x0000000000670000-memory.dmp

    Filesize

    192KB

  • memory/816-4-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

    Filesize

    9.9MB

  • memory/816-5-0x000000001D280000-0x000000001D6B8000-memory.dmp

    Filesize

    4.2MB

  • memory/816-0-0x000007FEF5163000-0x000007FEF5164000-memory.dmp

    Filesize

    4KB

  • memory/816-1-0x000000013FFA0000-0x00000001402C4000-memory.dmp

    Filesize

    3.1MB

  • memory/816-8-0x00000000008C0000-0x000000000095C000-memory.dmp

    Filesize

    624KB

  • memory/816-9-0x0000000000810000-0x0000000000816000-memory.dmp

    Filesize

    24KB

  • memory/816-10-0x00000000021E0000-0x0000000002212000-memory.dmp

    Filesize

    200KB

  • memory/816-2-0x000000001C370000-0x000000001C660000-memory.dmp

    Filesize

    2.9MB

  • memory/816-11-0x0000000000970000-0x0000000000974000-memory.dmp

    Filesize

    16KB

  • memory/816-20-0x000007FEF5163000-0x000007FEF5164000-memory.dmp

    Filesize

    4KB

  • memory/816-23-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2976-22-0x000000013F7B0000-0x000000013FAD4000-memory.dmp

    Filesize

    3.1MB

  • memory/2976-21-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2976-24-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2976-25-0x000000001B890000-0x000000001B902000-memory.dmp

    Filesize

    456KB

  • memory/2976-26-0x0000000000850000-0x0000000000856000-memory.dmp

    Filesize

    24KB

  • memory/2976-27-0x0000000000860000-0x000000000086A000-memory.dmp

    Filesize

    40KB

  • memory/2976-28-0x0000000000860000-0x000000000086A000-memory.dmp

    Filesize

    40KB

  • memory/2976-31-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2976-32-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

    Filesize

    9.9MB

  • memory/2976-33-0x0000000000860000-0x000000000086A000-memory.dmp

    Filesize

    40KB