Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:09

General

  • Target

    39a7f02d9e76b2b1d996ec00e73d9e5ad7a78380e50bf46ee013df73a37a10aa.exe

  • Size

    3.3MB

  • MD5

    58e145216b006e9458e1bd6227136341

  • SHA1

    bb3299286a7cc28539a3ddf77401981c3bb99b14

  • SHA256

    39a7f02d9e76b2b1d996ec00e73d9e5ad7a78380e50bf46ee013df73a37a10aa

  • SHA512

    4f93fb7fc2ea717ce0c5a6576bc7a40bdf896106098c05cf6fcd4dd5c9f71486c4bd6e5e68022fc83fcaba9e22bc953e8da18cc613d73e3c78b1f06707119f1a

  • SSDEEP

    98304:nRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/8xB:nkj8NBFwxpNOuk27xB

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39a7f02d9e76b2b1d996ec00e73d9e5ad7a78380e50bf46ee013df73a37a10aa.exe
    "C:\Users\Admin\AppData\Local\Temp\39a7f02d9e76b2b1d996ec00e73d9e5ad7a78380e50bf46ee013df73a37a10aa.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\i8Yn38o336ZrB.exe
      "C:\Users\Admin\AppData\Local\Temp\i8Yn38o336ZrB.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDM5YTdmMDJkOWU3NmIyYjFkOTk2ZWMwMGU3M2Q5ZTVhZDdhNzgzODBlNTBiZjQ2ZWUwMTNkZjczYTM3YTEwYWEuZXhl
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Windows\system32\sc.exe
          sc stop "SysMain"
          4⤵
          • Launches sc.exe
          PID:2712
        • C:\Windows\system32\sc.exe
          sc config "SysMain" start=disabled
          4⤵
          • Launches sc.exe
          PID:2828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\i8Yn38o336ZrB.exe

    Filesize

    3.5MB

    MD5

    e95e9541d95fe99da6a57a0bcedb4225

    SHA1

    a94a0a812b9971319317c90db5095adcca4220f6

    SHA256

    e61962c5b6aae48e52846a427bcc330c60bcd2e5473b932296b7598a962244e7

    SHA512

    3ea138d2e3f9372855092e153cbdbb39ff0e1bbaa3c7ede791974f12af2c3c075e75cfaa4ac457cf56c6b71221fad10111bb84605bfa93a10962ee160189fabf

  • memory/536-29-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

    Filesize

    9.9MB

  • memory/536-27-0x0000000000C00000-0x0000000000C0A000-memory.dmp

    Filesize

    40KB

  • memory/536-26-0x00000000009D0000-0x00000000009D6000-memory.dmp

    Filesize

    24KB

  • memory/536-25-0x00000000021E0000-0x0000000002252000-memory.dmp

    Filesize

    456KB

  • memory/536-24-0x0000000000C10000-0x0000000000C42000-memory.dmp

    Filesize

    200KB

  • memory/536-23-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

    Filesize

    9.9MB

  • memory/536-21-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

    Filesize

    9.9MB

  • memory/536-20-0x000000013F4F0000-0x000000013F814000-memory.dmp

    Filesize

    3.1MB

  • memory/1256-10-0x0000000000800000-0x0000000000832000-memory.dmp

    Filesize

    200KB

  • memory/1256-0-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

    Filesize

    4KB

  • memory/1256-11-0x00000000008B0000-0x00000000008B4000-memory.dmp

    Filesize

    16KB

  • memory/1256-9-0x00000000007B0000-0x00000000007B6000-memory.dmp

    Filesize

    24KB

  • memory/1256-8-0x000000001AC60000-0x000000001ACFC000-memory.dmp

    Filesize

    624KB

  • memory/1256-7-0x00000000007A0000-0x00000000007A6000-memory.dmp

    Filesize

    24KB

  • memory/1256-22-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

    Filesize

    9.9MB

  • memory/1256-6-0x0000000000780000-0x0000000000784000-memory.dmp

    Filesize

    16KB

  • memory/1256-5-0x000000001D080000-0x000000001D4B8000-memory.dmp

    Filesize

    4.2MB

  • memory/1256-4-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

    Filesize

    9.9MB

  • memory/1256-3-0x0000000000750000-0x0000000000780000-memory.dmp

    Filesize

    192KB

  • memory/1256-2-0x000000001C0C0000-0x000000001C3B0000-memory.dmp

    Filesize

    2.9MB

  • memory/1256-1-0x000000013F680000-0x000000013F9A4000-memory.dmp

    Filesize

    3.1MB