Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:25

General

  • Target

    0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791.exe

  • Size

    3.4MB

  • MD5

    c492e8c8507de24047598128c068f9b5

  • SHA1

    0102f531e7c1cd9d58280b7409bd5861740b1ea6

  • SHA256

    0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791

  • SHA512

    15edf4eb649784450e8ffbd726888d1b032074b206be7d328bfb35135704eaec50fa1807b3ab608fd3412d42b06b896afb37e5b96f51d1ce08b5e24e77951c72

  • SSDEEP

    98304:hRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/i7:hkj8NBFwxpNOuk2v7

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791.exe
    "C:\Users\Admin\AppData\Local\Temp\0ace08628fec1c94697c5b0e6bed6ea1a955772fb493a52cde144e662f214791.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6136
    • C:\Users\Admin\AppData\Local\Temp\4IAMX7o2LtCm3c.exe
      "C:\Users\Admin\AppData\Local\Temp\4IAMX7o2LtCm3c.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDBhY2UwODYyOGZlYzFjOTQ2OTdjNWIwZTZiZWQ2ZWExYTk1NTc3MmZiNDkzYTUyY2RlMTQ0ZTY2MmYyMTQ3OTEuZXhl
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6076
        • C:\Windows\system32\sc.exe
          sc stop "SysMain"
          4⤵
          • Launches sc.exe
          PID:3672
        • C:\Windows\system32\sc.exe
          sc config "SysMain" start=disabled
          4⤵
          • Launches sc.exe
          PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4IAMX7o2LtCm3c.exe

    Filesize

    3.3MB

    MD5

    bd4afb57cbaad7f9929e27917077174a

    SHA1

    5b4281b8feb12fae6ec93ec6931e6c348bfa8018

    SHA256

    1c86403a28ab7a8e13eb05d0f4ebd92292b030e8076bcb811e45ca24d2a38678

    SHA512

    2ec338418dc0026157dc05bdcc2bdb68f4d383b2bfa2f6228135440cfe2c5e9665470ab4e8b13d7f2c7392c863104e0f199ccafb70ded578aeb12e4574ac7f5c

  • memory/2176-37-0x00007FF979D60000-0x00007FF97A821000-memory.dmp

    Filesize

    10.8MB

  • memory/2176-36-0x00007FF979D60000-0x00007FF97A821000-memory.dmp

    Filesize

    10.8MB

  • memory/2176-35-0x0000028A744B0000-0x0000028A744BE000-memory.dmp

    Filesize

    56KB

  • memory/2176-34-0x0000028A75350000-0x0000028A75388000-memory.dmp

    Filesize

    224KB

  • memory/2176-33-0x0000028A71900000-0x0000028A71906000-memory.dmp

    Filesize

    24KB

  • memory/2176-32-0x0000028A719E0000-0x0000028A71A52000-memory.dmp

    Filesize

    456KB

  • memory/2176-31-0x00007FF979D60000-0x00007FF97A821000-memory.dmp

    Filesize

    10.8MB

  • memory/2176-29-0x00007FF979D60000-0x00007FF97A821000-memory.dmp

    Filesize

    10.8MB

  • memory/2176-28-0x0000028A6D860000-0x0000028A6DB84000-memory.dmp

    Filesize

    3.1MB

  • memory/6136-6-0x000002A9E81F0000-0x000002A9E81F4000-memory.dmp

    Filesize

    16KB

  • memory/6136-30-0x00007FF979D60000-0x00007FF97A821000-memory.dmp

    Filesize

    10.8MB

  • memory/6136-12-0x000002A9EA5B0000-0x000002A9EA5E2000-memory.dmp

    Filesize

    200KB

  • memory/6136-13-0x000002A9EA490000-0x000002A9EA494000-memory.dmp

    Filesize

    16KB

  • memory/6136-10-0x000002A9EA460000-0x000002A9EA468000-memory.dmp

    Filesize

    32KB

  • memory/6136-9-0x000002A9E9AB0000-0x000002A9E9AB6000-memory.dmp

    Filesize

    24KB

  • memory/6136-8-0x000002A9E9BE0000-0x000002A9E9C7C000-memory.dmp

    Filesize

    624KB

  • memory/6136-11-0x000002A9EBC30000-0x000002A9EBCEA000-memory.dmp

    Filesize

    744KB

  • memory/6136-7-0x000002A9E9AA0000-0x000002A9E9AA6000-memory.dmp

    Filesize

    24KB

  • memory/6136-0-0x00007FF979D63000-0x00007FF979D65000-memory.dmp

    Filesize

    8KB

  • memory/6136-5-0x000002A9EB7F0000-0x000002A9EBC28000-memory.dmp

    Filesize

    4.2MB

  • memory/6136-4-0x000002A9E81C0000-0x000002A9E81F0000-memory.dmp

    Filesize

    192KB

  • memory/6136-3-0x00007FF979D60000-0x00007FF97A821000-memory.dmp

    Filesize

    10.8MB

  • memory/6136-2-0x000002A9EA6A0000-0x000002A9EA990000-memory.dmp

    Filesize

    2.9MB

  • memory/6136-1-0x000002A9E7B10000-0x000002A9E7E34000-memory.dmp

    Filesize

    3.1MB